Make npm bootstrap resumable

[taras]

Why

New workspace packages need an npm package record before GitHub Actions can be
configured as their trusted publisher. A completed npm web-auth flow can leave
the bootstrap version published while the invoking command fails before
configuring trust, making the original bootstrap script impossible to rerun.

What changes

Before:

• The bootstrap script always required an absent npm package.
• A partial first run required manual recovery.
• Local npm registry settings could redirect the bootstrap.

After:

• The script publishes an absent bootstrap package or resumes the expected
  bootstrap state and configures trusted publishing.
• It targets public npm explicitly and documents an interactive-terminal,
  Volta-compatible workflow.

How it works

package lookup → publish only when absent → configure trusted publisher → verify tags and trust

Review guide

Start with: scripts/bootstrap-npm-package.md

Then review:

1. The distinction between an absent package, the expected bootstrap version,
   and an unexpected existing package.
2. The recovery path: an existing bootstrap version skips publication but still
   configures trusted publishing.
3. scripts/tests/bootstrap-npm-package.test.ts, which drives each state with
   a fake npm command.
4. The concise release-process contract.

Look carefully at:

• The script never overwrites an existing version or assigns latest.

What must stay true

• Only 0.0.0-bootstrap.0 under the bootstrap dist-tag is resumable — the
  script validates both before skipping publication.
• The implementation is not built or published by this script — the first
  tagged release remains responsible for latest.
• Trusted publishing remains bound to publish-packages.yml, the repository,
  and the npm-publish environment.

How to verify it

• The focused bootstrap suite proves absent packages publish before trust,
  expected bootstrap packages resume with no second publish, unexpected
  versions fail safely, and a package sitting at 0.0.0-bootstrap.0 under
  some other dist-tag is rejected with the expected-tag diagnostic without
  publishing or configuring trust. Disabling the dist-tag guard fails that
  fourth case alone, so it does not overlap the other three.
• deno task lint passes.
• deno task check:jsr passes.
• The tracked repository type-check passes.

The canonical deno task check and deno task test are blocked locally by an
untracked .claude/worktrees/issue-140-workspace-task-scope checkout that Deno
discovers and type-checks. Its pre-existing errors are outside this diff.

Scope

Included

• Resumable public-npm bootstrap and trusted-publisher setup.
• Operator instructions for npm web authentication and Volta.
• Focused behavior tests and the release-process contract.

Intentionally unchanged

• The 30-second executable-code-block timeout is tracked by Make executable code blocks use the CLI timeout #153.
• Package implementation builds remain the tagged release workflow's job.

Risks and limitations

• npm web authentication requires an interactive terminal. The document
  materializes its shell block until Make executable code blocks use the CLI timeout #153 removes the code-block timeout.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #154: Make npm bootstrap resumable

3 files, +334 / -13

Scope

✅ PR scope looks good.

Structural

🟡 1 console statements.

Slop

✅ Slop indicators look low.

Static Analysis

✅ Oxlint found no issues.

Correctness

No extraneous code patterns detected.

[taras]

Superseded by #308, which closes #276. That PR rebuilds this document on main around <Elicit>: the OTP is asked for at the point of use, so the npm commands are non-interactive and the awk-the-block-out-of-the-document workaround is gone. The shell guards, the preview/publish split, the empty 0.0.0-bootstrap.0 artifact under the bootstrap dist-tag, the npm trust github invocation, and the verification output all carry over from here.