Fix release signature audit and record publication evidence

.github/ISSUE_SPECS/003-npm-release-trusted-publishing.md

@@ -49,6 +49,33 @@ has exercised an OIDC publish. Any pending authentication remains explicit.
 
 ## Current status
 
-The local npm account is authenticated with write access to the organization,
-2FA is enabled, and `@misofm/codec` does not yet exist in the registry. Release
-workflow implementation, review, publication, and trust configuration are pending.
+Release tooling is merged through [PR 4](https://github.com/misofm/codec/pull/4).
+The release main commit is `12f54c988a2df319064e6ca3885268d976319cc1`, with
+[green CI](https://github.com/misofm/codec/actions/runs/34740760831). Fresh Sol
+review signed off `5d7e1a7ceb667276c84934e0a61e95c725e5cae6`; the merge has the
+same tree. Review evidence is in `../RELEASE_EVIDENCE/003/review.md`.
+
+The exact main commit passed the complete ten-combination packed-consumer matrix
+under npm 11.19.1. The retained 139,230-byte tarball has SHA-256
+`3c318e0e5ccb861994b5084f5b3aeea857d79c5ae78f5fc412f2e85d8dd10a36` and integrity
+`sha512-Oleo8mUbyNzooQIgOsdxfxBYGhBXAJyGvZCna5cTcD8vGdfgcxMTUvzbCSccEOUYQ6vg+87WbI0UYmcEQpAk0w==`.
+The consumer and package receipt is in
+`../RELEASE_EVIDENCE/003/qualified-tarball.json`.
+
+`@misofm/codec@0.1.0` was published through the authorized local npm CLI with
+`--ignore-scripts --provenance=false`. The registry reports `latest: 0.1.0`.
+Downloaded registry bytes match both recorded digests, and the normal registry
+package passed the full ten-combination consumer matrix. Receipts are in
+`../RELEASE_EVIDENCE/003/registry-artifact.json` and `registry-consumer.json`.
+
+npm confirmed trusted publisher `26f5b08e-325d-42b8-85e3-bdc68ae84ddb`, provider
+GitHub, repository `misofm/codec`, workflow `npm-publish.yml`, with direct publish
+and npm's default stage-publish permissions. A separate read-back authentication
+is pending.
+
+The initial [verify workflow](https://github.com/misofm/codec/actions/runs/34741165009)
+passed qualification, registry byte comparison, and all registry consumers. Its
+final signature audit step failed on shell heredoc indentation. A workflow-only
+fix preserves the audit and provenance gates; all fourteen extracted shell blocks
+now pass `bash -n`, and actionlint passes. Fresh review and a green verify dispatch
+of that correction remain required. Verify mode does not exercise OIDC publication.

.github/RELEASE_EVIDENCE/003/qualified-tarball.json

@@ -0,0 +1,177 @@
+{
+  "tarballFilename": "misofm-codec-0.1.0.tgz",
+  "tarballSha256": "3c318e0e5ccb861994b5084f5b3aeea857d79c5ae78f5fc412f2e85d8dd10a36",
+  "tarballIntegrity": "sha512-Oleo8mUbyNzooQIgOsdxfxBYGhBXAJyGvZCna5cTcD8vGdfgcxMTUvzbCSccEOUYQ6vg+87WbI0UYmcEQpAk0w==",
+  "packedBytes": 139230,
+  "unpackedBytes": 418452,
+  "files": [
+    "LICENSE",
+    "README.md",
+    "THIRD_PARTY_NOTICES.md",
+    "dist/decode.d.ts",
+    "dist/decode.d.ts.map",
+    "dist/decode.js",
+    "dist/decode.js.map",
+    "dist/decoder-errors.d.ts",
+    "dist/decoder-errors.d.ts.map",
+    "dist/decoder-errors.js",
+    "dist/decoder-errors.js.map",
+    "dist/decoder-wasm.d.ts",
+    "dist/decoder-wasm.d.ts.map",
+    "dist/decoder-wasm.js",
+    "dist/decoder-wasm.js.map",
+    "dist/encode.d.ts",
+    "dist/encode.d.ts.map",
+    "dist/encode.js",
+    "dist/encode.js.map",
+    "dist/errors.d.ts",
+    "dist/errors.d.ts.map",
+    "dist/errors.js",
+    "dist/errors.js.map",
+    "dist/format.d.ts",
+    "dist/format.d.ts.map",
+    "dist/format.js",
+    "dist/format.js.map",
+    "dist/index.d.ts",
+    "dist/index.d.ts.map",
+    "dist/index.js",
+    "dist/index.js.map",
+    "dist/internal/decoder-abi.d.ts",
+    "dist/internal/decoder-abi.d.ts.map",
+    "dist/internal/decoder-abi.js",
+    "dist/internal/decoder-abi.js.map",
+    "dist/internal/encoder-abi.d.ts",
+    "dist/internal/encoder-abi.d.ts.map",
+    "dist/internal/encoder-abi.js",
+    "dist/internal/encoder-abi.js.map",
+    "dist/node.d.ts",
+    "dist/node.d.ts.map",
+    "dist/node.js",
+    "dist/node.js.map",
+    "dist/wasm.d.ts",
+    "dist/wasm.d.ts.map",
+    "dist/wasm.js",
+    "dist/wasm.js.map",
+    "docs/adapter-integration.md",
+    "docs/architecture.md",
+    "package.json",
+    "vendor/licenses/compiler-rt.txt",
+    "vendor/licenses/emscripten.txt",
+    "vendor/licenses/libFLAC.txt",
+    "vendor/licenses/musl.txt",
+    "wasm/flac-decoder.manifest.json",
+    "wasm/flac-decoder.wasm",
+    "wasm/flac-encoder.manifest.json",
+    "wasm/flac-encoder.wasm"
+  ],
+  "consumers": [
+    {
+      "effect": "4.0.0-rc.112",
+      "bun": {
+        "runtime": "Bun 1.4.2",
+        "formats": 4,
+        "verifiedFrames": 32772,
+        "verifiedBytes": 122895,
+        "cancellation": true,
+        "truncation": true
+      },
+      "node": {
+        "runtime": "Node v22.23.2",
+        "formats": 4,
+        "verifiedFrames": 32772,
+        "verifiedBytes": 122895,
+        "cancellation": true,
+        "truncation": true
+      },
+      "browser": [
+        {
+          "browser": "chromium",
+          "version": "151.0.7922.34",
+          "worker": {
+            "formats": 4,
+            "verifiedFrames": 32772,
+            "verifiedBytes": 122895,
+            "cancellation": true,
+            "truncation": true
+          }
+        },
+        {
+          "browser": "firefox",
+          "version": "153.0",
+          "worker": {
+            "formats": 4,
+            "verifiedFrames": 32772,
+            "verifiedBytes": 122895,
+            "cancellation": true,
+            "truncation": true
+          }
+        },
+        {
+          "browser": "webkit",
+          "version": "26.5",
+          "worker": {
+            "formats": 4,
+            "verifiedFrames": 32772,
+            "verifiedBytes": 122895,
+            "cancellation": true,
+            "truncation": true
+          }
+        }
+      ]
+    },
+    {
+      "effect": "4.0.0-rc.115",
+      "bun": {
+        "runtime": "Bun 1.4.2",
+        "formats": 4,
+        "verifiedFrames": 32772,
+        "verifiedBytes": 122895,
+        "cancellation": true,
+        "truncation": true
+      },
+      "node": {
+        "runtime": "Node v22.23.2",
+        "formats": 4,
+        "verifiedFrames": 32772,
+        "verifiedBytes": 122895,
+        "cancellation": true,
+        "truncation": true
+      },
+      "browser": [
+        {
+          "browser": "chromium",
+          "version": "151.0.7922.34",
+          "worker": {
+            "formats": 4,
+            "verifiedFrames": 32772,
+            "verifiedBytes": 122895,
+            "cancellation": true,
+            "truncation": true
+          }
+        },
+        {
+          "browser": "firefox",
+          "version": "153.0",
+          "worker": {
+            "formats": 4,
+            "verifiedFrames": 32772,
+            "verifiedBytes": 122895,
+            "cancellation": true,
+            "truncation": true
+          }
+        },
+        {
+          "browser": "webkit",
+          "version": "26.5",
+          "worker": {
+            "formats": 4,
+            "verifiedFrames": 32772,
+            "verifiedBytes": 122895,
+            "cancellation": true,
+            "truncation": true
+          }
+        }
+      ]
+    }
+  ]
+}

.github/RELEASE_EVIDENCE/003/registry-artifact.json

@@ -0,0 +1,10 @@
+{
+  "package": "@misofm/codec",
+  "version": "0.1.0",
+  "releaseCommit": "12f54c988a2df319064e6ca3885268d976319cc1",
+  "registryTarball": "https://registry.npmjs.org/@misofm/codec/-/codec-0.1.0.tgz",
+  "tarballSha256": "3c318e0e5ccb861994b5084f5b3aeea857d79c5ae78f5fc412f2e85d8dd10a36",
+  "tarballIntegrity": "sha512-Oleo8mUbyNzooQIgOsdxfxBYGhBXAJyGvZCna5cTcD8vGdfgcxMTUvzbCSccEOUYQ6vg+87WbI0UYmcEQpAk0w==",
+  "tarballBytes": 139230,
+  "provenance": "local bootstrap; no CI attestation"
+}