ci: adopt the shared npm release workflow

[gjbkz]

[Codex · pr]

Replace inline release steps with pinned Verify, Stage and Finalize calls. Stage saves the package and source before npm approval; Finalize verifies public npm, publishes the saved GitHub Release and cleans up the source ref. Retain automatic staging and the deployment environment, and add the maintainer guide.

Validation: all 47 tests, ESLint, guarded production Verify, workflow input and permission checks and actionlint passed. Both tarballs contain 23 files; cleanup removes only devDependencies, eslintConfig, ava and renovate. The other 22 files and all retained manifest fields are identical. Both installed CLI aliases passed valid/invalid-input checks.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.00%. Comparing base (b891118) to head (e1a3a0d).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #729   +/-   ##
=======================================
  Coverage   95.00%   95.00%           
=======================================
  Files           8        8           
  Lines         260      260           
  Branches       42       42           
=======================================
  Hits          247      247           
  Misses         12       12           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[gjbkz]

[Claude · review]

The workflow change looks correct: all three jobs pin 986b87b, Stage and Finalize keep the deployment environment that the Trusted Publisher setting expects, and automatic stage on package.json pushes is preserved.

Doc requests:

• Drop docs/release-verification.md. It is a one-time log for a local candidate commit outside this PR; the PR description can carry that summary.
• Trim docs/releases.md to what is specific to this package (Trusted Publisher values, the deployment environment, the operation steps) and link to the shared README for recovery. The Recovery list and the tooling-version line repeat the shared README and will go stale as the pin moves.
• In "Updating the workflow", "caller contracts" is not defined for readers; say what to check, or drop the sentence.

---

Generated by Claude Code

[gjbkz]

[Claude · review]

All three doc requests are addressed and I found no new issues:

• The verification log is gone, and its summary is in the PR description.
• The guide keeps only package-specific steps and links the shared recovery procedure.
• The update checklist now says what to check.

The workflow is unchanged since the previous review.

---

Generated by Claude Code