ci: publishing is a tag, and the workflow refuses to publish the wrong thing

[devin-ai-integration]

Summary

npm view fdeops version → 3.10.2, while Main is 3.11.0. Four releases of safety fixes (installer ownership, engagement misrouting, hook resolution, the eval-receipt gate) are merged and unreachable, because publishing was a manual step on one laptop behind a 2FA prompt.

This makes a release a tag, so the bytes on the registry always map to a commit:

git pull && git tag v3.11.0 && git push origin v3.11.0

The workflow's value is in what it refuses, not in the npm publish line:

tag vs package.json     # v3.11.0 with package.json at 3.11.1 → fail before publish
npm run check           # gates + 119 tests
npm view fdeops@$v      # already published → fail (no accidental re-run)
npm publish --provenance --access public
npm view fdeops         # poll until the registry actually serves $v, else fail

Provenance is on, which is why the job needs id-token: write.

One thing needed before a tag will publish: repository secret NPM_TOKEN — an npm Automation token (granular, read+write, scoped to fdeops). Automation tokens are exempt from 2FA; a Classic/Publish token with 2FA enforced will fail in CI. workflow_dispatch is wired too, taking the version as an input, for a re-run without cutting a new tag.

Release steps documented in CONTRIBUTING.md, including the four manifests that must agree (npm run check already enforces that).

No change to the CLI, the skill, .fde/, or the published package contents. Verified npm pack --dry-run carries bin/lib/vault.js (13.4kB, 92 files) so fde vault works for an installer, and npm run check is green: 119/119.

Link to Devin session: https://app.devin.ai/sessions/f135381c4682413bae73dff38eb6d1a3
Open in Devin Desktop: https://app.devin.ai/desktop/session/f135381c4682413bae73dff38eb6d1a3?variant=devin
Requested by: @suboss87

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring