release: verify npm publish via registry integrity before CDN replication

[DecisionNerd]

Objective

Resume the partial v0.5.0 npm publication without false failures while npm metadata is live but its tarball CDN still returns 404.

Evidence

• Run 30687709938 published @curatelabs/graphforge-darwin-arm64@0.5.0, then timed out after five minutes waiting for the public tarball URL.
• Run 30688134001 checksum-verified that package, published @curatelabs/graphforge-darwin-x64@0.5.0, and encountered the same delayed CDN replication.
• npm package metadata exposes dist.integrity immediately while the dist.tarball URL still returns HTTP 404.

Acceptance criteria

• Compare each recorded local tarball to npm dist.integrity using the declared SRI algorithm before treating an existing or newly published version as identical.
• Fail closed on unsupported/malformed integrity or different bytes.
• Preserve checksum-safe resume and ordered publication.
• Add deterministic regression tests.
• Do not rebuild, replace, or republish existing package bytes.
• Resume only the same retained v0.5.0 candidate after normal PR CI.

[coderabbitai]

🔗 Related PRs

#235 - feat(cli): add Python and Node lifecycle launchers [open]
#271 - release: preserve exact M1 publication candidate [open]
#282 - fix(release): resume immutable v0.5.0 publication [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[DecisionNerd]

Run 30688555125 published the third native package, then executed the tagged older publisher and repeated the CDN timeout. Recovery must overlay the reviewed main publication control script while retaining only tagged candidate bytes. No conflicting bytes were written.