Reuse successful CI artifacts for npm releases

[chh-ay]

Changes

• require a successful completed push CI run for the exact tagged commit
• download and rehash that run's canonical tarballs before trusted publication
• bind publication to the artifact commit and coordinated package version
• remove duplicate source, quality, coverage, browser, consumer, and artifact-build gates from the tag workflow

Verification

• 140 tooling tests passed
• release workflow rejects failed, incomplete, pull-request, and wrong-commit CI runs
• downloaded and verified all six canonical tarballs from merged CI run 29684155115

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sheetwrite	Ready	Preview, Comment	Jul 19, 2026 11:43am