ci: gate npm publish on CI and Nix Build, assert full native bundle set

- Release now waits for the CI and Nix Build workflows to succeed on the
  same commit before publishing (npm publish is irreversible)
- Publish-native-assets refuses a partial release when any of the six
  target bundles is missing
- timeout-minutes on all release jobs

Author: elkaix

.github/workflows/release.yml

@@ -8,9 +8,48 @@ on:
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
+  # Publishing to npm is irreversible — never let a commit that fails CI or
+  # Nix Build ship. Those workflows run in parallel on the same push, so this
+  # job blocks the release until both conclude successfully for this SHA.
+  wait-for-checks:
+    name: Wait for CI and Nix Build
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'Pythoughts-labs'
+    timeout-minutes: 45
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - name: Wait for required workflows on this commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SHA: ${{ github.sha }}
+          REPO: ${{ github.repository }}
+        run: |
+          for workflow in "CI" "Nix Build"; do
+            echo "Waiting for workflow: $workflow"
+            while true; do
+              # Transient API failures must not kill the gate (step shell is -e).
+              pair=$(gh api "repos/$REPO/actions/runs?head_sha=$SHA&per_page=50" \
+                --jq "[.workflow_runs[] | select(.name==\"$workflow\")][0] | \"\(.status)/\(.conclusion)\"" \
+                2>/dev/null) || pair="api-error/null"
+              case "$pair" in
+                completed/success)
+                  echo "$workflow: success"; break ;;
+                completed/*)
+                  echo "::error::$workflow concluded '${pair#completed/}' for $SHA — refusing to release."
+                  exit 1 ;;
+                *)
+                  echo "$workflow: $pair — waiting..."; sleep 30 ;;
+              esac
+            done
+          done
+
   release:
     name: Release
+    needs: wait-for-checks
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: github.repository_owner == 'Pythoughts-labs'
     outputs:
       packages_published: ${{ steps.changesets.outputs.published }}
@@ -77,6 +116,7 @@ jobs:
   # registry dependency), so no deploy webhook is fired here — this job only
   # verifies the published release is internally consistent.
   verify-cdn-release:
+    timeout-minutes: 15
     name: Verify release consistency
     needs: release
     if: needs.release.outputs.packages_published == 'true'
@@ -96,6 +136,7 @@ jobs:
         run: node scripts/release/verify-release-consistency.mjs
 
   update-brew-tap:
+    timeout-minutes: 15
     name: Update Homebrew tap
     needs: release
     if: needs.release.outputs.packages_published == 'true'
@@ -146,6 +187,7 @@ jobs:
       APPLE_NOTARIZATION_ISSUER_ID: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }}
 
   publish-native-assets:
+    timeout-minutes: 15
     name: Publish native release assets
     needs:
       - release
@@ -166,6 +208,17 @@ jobs:
           path: dist-native-release
           merge-multiple: true
 
+      - name: Assert all native targets are present
+        run: |
+          missing=0
+          for target in darwin-arm64 darwin-x64 linux-arm64 linux-x64 win32-arm64 win32-x64; do
+            if ! ls dist-native-release/pythinker-code-"$target".zip >/dev/null 2>&1; then
+              echo "::error::Missing native bundle for $target — refusing to publish a partial release."
+              missing=1
+            fi
+          done
+          exit $missing
+
       - name: Produce manifest.json
         env:
           RELEASE_TAG: ${{ needs.release.outputs.pythinker_release_tag }}