Fix JSR trusted publishing authorization for @git-stunts scope

[flyingrobots]

Problem

The v18.1.1 release workflow published npm successfully and created the GitHub Release, but the JSR publish job failed three times.

Evidence

Release workflow: https://github.com/git-stunts/git-warp/actions/runs/28144853400
Failed JSR job: https://github.com/git-stunts/git-warp/actions/runs/28144853400/job/83350310168
GitHub Release: https://github.com/git-stunts/git-warp/releases/tag/v18.1.1

Log excerpt from Publish JSR (retry x3):

Failed to publish @git-stunts/git-warp@18.1.1
The actor that this request was authenticated for is not authorized as a scope member for this scope. (actorNotScopeMember)

Confirmed state after the run:

npm @git-stunts/git-warp@18.1.1: published
JSR @git-stunts/git-warp@18.1.1: not published
GitHub Release v18.1.1: published, body reports JSR failed

Expected Outcome

JSR trusted publishing should be authorized for the actor/environment used by release.yml, so a release tag can publish both npm and JSR without manual intervention.

Suggested Mitigation

1. Inspect the JSR package/scope settings for @git-stunts/git-warp.
2. Authorize the GitHub Actions actor/environment used by git-stunts/git-warp releases as a scope member or trusted publisher.
3. Re-run only the failed JSR publish job for v18.1.1 once authorization is corrected.
4. Consider making the release summary link directly to registry-specific rerun instructions when exactly one registry fails.

[flyingrobots]

Additional verification after checking the current JSR guidance:

• release.yml already has the documented OIDC permission on publish_jsr:
  • permissions.contents: read
  • permissions.id-token: write
  • publish step runs npx -y jsr publish
• The same job-level OIDC pattern also exists on publish_npm; npm published successfully.
• Re-ran only the failed JSR job on release run 28144853400.
  • Fresh JSR job: 83490288164
  • Attempts 1 and 2 failed with the same root cause:

The actor that this request was authenticated for is not authorized as a scope member for this scope. (actorNotScopeMember)

• Attempt 3 then hit JSR rate limiting:

429 Too Many Requests: Rate exceeded.

Conclusion: this is not a missing id-token: write workflow permission. The workflow already matches the documented OIDC shape. The remaining fix is in JSR authorization/trusted-publisher membership for the actor represented by git-stunts/git-warp and/or the release job identity.

[flyingrobots]

Resolved: v18.1.1 was published to JSR after dispatching release.yml manually as flyingrobots, a JSR @git-stunts scope member. The automated github-actions[bot] dispatch remains a future automation policy question, but the release artifact is complete.