fix: record explicit release outcomes without publishing - #690

Summary

• Make Release packages write one explicit outcome (version-maintenance-only, qualified-without-publish, published, or failed) with executed/skipped stages, so a Version Packages PR refresh is not mistaken for qualification or publication.
• Reuse run-packed-tests.mjs for candidate evidence (package names/versions, tarball sha256, inter-package ranges, no workspace: leftovers, every declared bin) against the exact versioned SHA; registry npm view runs only when publication is separately authorized.
• Follow-ups Workbench: resolve exact compiled executable from manifest; fail-closed preflight (no flight probing) #680/Bound Workbench producer / completed-envelope render history end to end #681/Prove successful native Claude Code / Codex host sessions in Workbench #683/Legacy uninstall must not infer external state purge ownership from the current environment #685/Stream generated MCP/event Flight bytes before render completion #686/Workbench inspector must not infer resultSchema declaration or validation from result presence #688 are recorded against that SHA (pending is valid). Does not merge or publish Version Packages Version Packages #411.

Closes #687

Test plan

• bash scripts/release-outcome-summary.sh fixture + pnpm exec rstest --config rstest.unit.config.ts packages/agent-bundle/tests/release-outcome-summary.test.ts (4 cases: maintenance / qualified+evidence / cancelled→failed / published)
• pnpm test:packed — 14 files, 39 passed, 1 skipped; evidence written; workspace refs none; bins agent-bundle + create-agent-bundle
• pnpm build && pnpm typecheck && pnpm lint — pass
• pnpm test:unit — 4396 tests; one unrelated 30s timeout in route-invocation-service.test.ts under load; isolated retry passed
• pnpm docs:site:build — pass (0 locale drift, 0 broken links)
• actionlint .github/workflows/release.yml — only pre-existing intentional SC2016 on ${NPM_TOKEN}
• skip-changeset (workflow/docs/tests only)

Local gate (paste)

pnpm build          # pass
pnpm typecheck      # pass
pnpm lint           # pass (1477 files)
pnpm test:unit      # 4389 passed / 1 flake timeout (retry pass) / 6 skipped
pnpm test:packed    # 39 passed / 1 skipped
pnpm docs:site:build # pass

Example summary (qualified-without-publish)

outcome: qualified-without-publish
workflow_sha: b435f7b9179271cbff81d3e40d14ee342cbd65dd
candidate_sha: b435f7b9179271cbff81d3e40d14ee342cbd65dd
publication: NOT PUBLISHED

stages:
- version-maintenance: skipped
- qualification: executed
- publication: skipped
- registry-verification: skipped

packages:
- rsc-markdown-stream@0.1.0 rsc-markdown-stream-0.1.0.tgz sha256:5c154ac6941ded2a970e13c2e0d13ee34f2e0e7a9ccf34a1524f3a9408401b7a
- create-agent-bundle@0.0.0 create-agent-bundle-0.0.0.tgz sha256:3cb15dfcd477f70d52b691d5a4feea36b26a431e33679cb7e3e6bc1a025cdc43
- @agent-bundle/runtime@0.0.0 agent-bundle-runtime-0.0.0.tgz sha256:06dfd52047133c0a5a75b4011dc87cddeceacb07fe6ccc3b032c34fc7ef1cde0
- agent-bundle@0.1.0 agent-bundle-0.1.0.tgz sha256:5d8a5b53256b04f1cc265826e3dbdac4a1ebfdbc2d9026291fa28899fea17414

inter-package ranges:
- @agent-bundle/runtime dependencies rsc-markdown-stream: ^0.1.0
- agent-bundle peerDependencies @agent-bundle/runtime: >=0.0.0 <1

workspace-only refs:
- none

test groups:
- packed: executed

executed bins:
- create-agent-bundle
- agent-bundle

follow-ups vs b435f7b9179271cbff81d3e40d14ee342cbd65dd:
- #680 executable/preflight selection: pending
- #681 retention: pending
- #683 native acceptance: pending
- #685 legacy purge: pending
- #686 production Flight streaming: pending
- #688 schema-label provenance: pending

This merge to main will itself be version-maintenance-only (pending changesets refresh #411; not a Version Packages commit). NOT PUBLISHED.

Deslop

Deslop: grok-4.6, 2 edits (dropped hardcoded packedCoverage claims; set -u-safe follow-up loop).

Self-review

Reviewer: Claude Fable high (change-risk-reviewer, Review).

First pass (9c070fd):

1. HIGH runner.temp at job env — fixed (github.workspace)
2. MEDIUM registry step missing NPM_TOKEN — fixed
3. MEDIUM cancelled → version-maintenance-only — fixed (maps to failed)
4. MEDIUM only one outcome tested — fixed (4 cases)
5. LOW hard-coded follow-up list — accepted
6. LOW process.exit skipped finally — fixed (throw)
7. LOW no-op main undocumented — fixed (docs sentence)

Second pass (a042944): no remaining merge risks.