fix: record explicit release outcomes without publishing

[ScriptedAlchemy]

Summary

• Make Release packages write one explicit outcome (version-maintenance-only, qualified-without-publish, published, or failed) with executed/skipped stages, so a Version Packages PR refresh is not mistaken for qualification or publication.
• Reuse run-packed-tests.mjs for candidate evidence (package names/versions, tarball sha256, inter-package ranges, no workspace: leftovers, every declared bin) against the exact versioned SHA; registry npm view runs only when publication is separately authorized.
• Follow-ups Workbench: resolve exact compiled executable from manifest; fail-closed preflight (no flight probing) #680/Bound Workbench producer / completed-envelope render history end to end #681/Prove successful native Claude Code / Codex host sessions in Workbench #683/Legacy uninstall must not infer external state purge ownership from the current environment #685/Stream generated MCP/event Flight bytes before render completion #686/Workbench inspector must not infer resultSchema declaration or validation from result presence #688 are recorded against that SHA (pending is valid). Does not merge or publish Version Packages Version Packages #411.

Closes #687

Test plan

• bash scripts/release-outcome-summary.sh fixture + pnpm exec rstest --config rstest.unit.config.ts packages/agent-bundle/tests/release-outcome-summary.test.ts (4 cases: maintenance / qualified+evidence / cancelled→failed / published)
• pnpm test:packed — 14 files, 39 passed, 1 skipped; evidence written; workspace refs none; bins agent-bundle + create-agent-bundle
• pnpm build && pnpm typecheck && pnpm lint — pass
• pnpm test:unit — 4396 tests; one unrelated 30s timeout in route-invocation-service.test.ts under load; isolated retry passed
• pnpm docs:site:build — pass (0 locale drift, 0 broken links)
• actionlint .github/workflows/release.yml — only pre-existing intentional SC2016 on ${NPM_TOKEN}
• skip-changeset (workflow/docs/tests only)

Local gate (paste)

pnpm build          # pass
pnpm typecheck      # pass
pnpm lint           # pass (1477 files)
pnpm test:unit      # 4389 passed / 1 flake timeout (retry pass) / 6 skipped
pnpm test:packed    # 39 passed / 1 skipped
pnpm docs:site:build # pass

Example summary (qualified-without-publish)

outcome: qualified-without-publish
workflow_sha: b435f7b9179271cbff81d3e40d14ee342cbd65dd
candidate_sha: b435f7b9179271cbff81d3e40d14ee342cbd65dd
publication: NOT PUBLISHED

stages:
- version-maintenance: skipped
- qualification: executed
- publication: skipped
- registry-verification: skipped

packages:
- rsc-markdown-stream@0.1.0 rsc-markdown-stream-0.1.0.tgz sha256:5c154ac6941ded2a970e13c2e0d13ee34f2e0e7a9ccf34a1524f3a9408401b7a
- create-agent-bundle@0.0.0 create-agent-bundle-0.0.0.tgz sha256:3cb15dfcd477f70d52b691d5a4feea36b26a431e33679cb7e3e6bc1a025cdc43
- @agent-bundle/runtime@0.0.0 agent-bundle-runtime-0.0.0.tgz sha256:06dfd52047133c0a5a75b4011dc87cddeceacb07fe6ccc3b032c34fc7ef1cde0
- agent-bundle@0.1.0 agent-bundle-0.1.0.tgz sha256:5d8a5b53256b04f1cc265826e3dbdac4a1ebfdbc2d9026291fa28899fea17414

inter-package ranges:
- @agent-bundle/runtime dependencies rsc-markdown-stream: ^0.1.0
- agent-bundle peerDependencies @agent-bundle/runtime: >=0.0.0 <1

workspace-only refs:
- none

test groups:
- packed: executed

executed bins:
- create-agent-bundle
- agent-bundle

follow-ups vs b435f7b9179271cbff81d3e40d14ee342cbd65dd:
- #680 executable/preflight selection: pending
- #681 retention: pending
- #683 native acceptance: pending
- #685 legacy purge: pending
- #686 production Flight streaming: pending
- #688 schema-label provenance: pending

This merge to main will itself be version-maintenance-only (pending changesets refresh #411; not a Version Packages commit). NOT PUBLISHED.

Deslop

Deslop: grok-4.6, 2 edits (dropped hardcoded packedCoverage claims; set -u-safe follow-up loop).

Self-review

Reviewer: Claude Fable high (change-risk-reviewer, Review).

First pass (9c070fd):

1. HIGH runner.temp at job env — fixed (github.workspace)
2. MEDIUM registry step missing NPM_TOKEN — fixed
3. MEDIUM cancelled → version-maintenance-only — fixed (maps to failed)
4. MEDIUM only one outcome tested — fixed (4 cases)
5. LOW hard-coded follow-up list — accepted
6. LOW process.exit skipped finally — fixed (throw)
7. LOW no-op main undocumented — fixed (docs sentence)

Second pass (a042944): no remaining merge risks.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a042944

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR