ci: stage npm releases for maintainer approval

[gjbkz]

The npm release workflow currently relies on a long-lived token or directly publishes packages. Use GitHub Actions OIDC to submit each npm release with npm stage publish. A maintainer reviews the staged artifact and approves it with 2FA before it becomes publicly available; a successful Actions job alone no longer means the npm release is live.

Grant the npm job id-token: write/contents: read, remove the publish-step NODE_AUTH_TOKEN, disable npm dependency caching, and install npm 11.21.0 explicitly (staged publishing requires npm >=11.15.0). Preserve build/package preparation, the release: published trigger, environment, and any JSR publishing job. JSR publishing remains automatic.

Validation: actionlint passed for all five revised workflows. npm 11.21.0 recognizes the stage command, and npm stage publish --dry-run --ignore-scripts --provenance=false passed against local artifact copies. Already-published versions were rejected, as expected; those copies used temporary prerelease versions with an explicit stage-check tag for validation. Repository versions and release tags were not changed. No package was uploaded, staged, or approved. OIDC/provenance still requires the actual GitHub Actions run. Previous build/test/pack validation is recorded in the task history.

The owner reports npm Trusted Publisher configuration is complete with both Allow npm publish and Allow npm dist-tag unchecked: GitHub Actions / nlibjs / typing / release.yml / environment none. After merging and running a release, review the package under npmjs.com → Staged Packages → Approve and complete 2FA. Do not enable direct publish for this flow.

Reference: https://docs.npmjs.com/staged-publishing/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.46%. Comparing base (1ead0f5) to head (cd25297).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #457   +/-   ##
=======================================
  Coverage   98.46%   98.46%           
=======================================
  Files          52       52           
  Lines        3057     3057           
  Branches      327      327           
=======================================
  Hits         3010     3010           
  Misses         46       46           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[gjbkz]

Reviewed commit d50d74b49fb45f5ecde3320a6cf0cb3d9820f8a1.

No actionable issues found in the workflow change, subject to the explicitly documented npm-side Trusted Publisher setup.

The PublishNpm job retains id-token: write, runs on a GitHub-hosted Ubuntu runner, uses Node 26 with an npm version supporting Trusted Publishing, and publishes to the npm registry with provenance. Removing the explicit NPM_TOKEN binding is consistent with using OIDC authentication. The PR description identifies the required npm Trusted Publisher registration for organization nlibjs, repository typing, and workflow release.yml.

Validation: reviewed the complete release workflow and confirmed that the GitHub Actions test workflow for this commit passed. The release workflow itself was not executed during this review; npm-side publisher registration and a successful authenticated publish remain unverified. Configure the Trusted Publisher before the next release. This change does not itself republish the missing v4.0.1 version, and it does not establish the root cause of the historical E404.