feat(wiki-write-core): publish to npm from main

[marcusrbrown]

Part of #3998.

This publishes @fro.bot/wiki-write-core to npm from main with semantic-release. Only commits that touch packages/wiki-write-core/ cut a release. The package is on the 0.x line, starting from the wiki-write-core-v0.0.0 tag on #4004's merge commit. Merging this PR publishes 0.1.0.

How a release is decided

scripts/wiki-write-core-release.ts decide performs these steps:

1. Finds the highest-semver wiki-write-core-v* tag reachable from HEAD. If no such tag is reachable, it fails.
2. Keeps only the commits after that tag that touch packages/wiki-write-core/, and drops any marked [skip release] or [release skip].
3. Runs the real @semantic-release/commit-analyzer and release-notes-generator on those commits, using packages/wiki-write-core/.releaserc.yaml. That config uses the same releaseRules as fro-bot/agent, so breaking changes, feat and build bump minor and fix bumps patch.

A major release from a 0.x base is rejected, both in decide and again in publish.

Workflow

.github/workflows/release-wiki-write-core.yaml runs on push to main and on workflow_dispatch.

Job	Credentials	Does
decide	none	Release type, version, base tag, and the notes artifact
build	none	Rebuilds dist and fails if it differs from the committed dist
publish	contents: write, id-token: write, environment release	Validates the decide outputs, recomputes the version, checks it against git, writes a gated .releaserc.json, and runs semantic-release --ci

• publish runs no repo code.
• It installs the pinned release tools into a scratch prefix with lifecycle scripts disabled.
• NPM_TOKEN and the GitHub token are set only on the semantic-release step.
• No GitHub App token is minted.
• The release tool versions are pinned once, in the workflow env, and Renovate tracks them. A new packageRule turns patch updates back on for them.

Bootstrap state

• The release environment exists, with a deployment-branch policy that allows only main.
• NPM_TOKEN is set as an environment secret on release. It is a granular token scoped to @fro.bot, for this first publish only.
• The tag wiki-write-core-v0.0.0 points at 084b58f.

After this PR: configure the npm trusted publisher for release-wiki-write-core.yaml and environment release, then remove NPM_TOKEN in a follow-up so later releases publish through OIDC. On the same day, revoke the token and delete the secret.

Verification

• pnpm check-types, pnpm lint, pnpm test (5620 passed), actionlint, pnpm check:mutation-guards and pnpm check:renovate-config all exit 0. The lockfile is unchanged.
• The real-plugin integration suite passes against a scratch install of the pinned tools.
• I simulated a squash merge of this branch onto main (a clone with the real wiki-write-core-v0.0.0 tag) and decide returned type=minor, version=0.1.0, base-tag=wiki-write-core-v0.0.0.
• I ran semantic-release --dry-run with the gated config. It accepted 0.1.0 and rejected 0.2.0 at verifyRelease.

[fro-bot]

Verdict: PASS

No material defects found in the nine changed files. Package-scoped release decisions, isolated publish credentials, and version validation are backed by meaningful failure-path tests.

Blocking issues

None

Non-blocking concerns

None

Missing tests

None identified. Focused suites: 154 passed, 21 skipped; skipped cases require the pinned scratch-installed release tools. Workflow YAML shape and action SHA references validated; actionlint was unavailable. Live publishing was not exercised.

Risk assessment (MED) + rationale

This introduces automatic npm publication with write credentials. The separate build/decision jobs, validated publish inputs, disabled lifecycle scripts, and release environment constrain that risk. The environment's main-only policy is author-reported, not independently verified; this follows the boundary described in the dispatch-ref learning.

---

Run Summary

Field	Value
Event	pull_request
Repository	fro-bot/.github
Run ID	39207601450
Cache	hit
Session	ses_ead3e80a7ffemQRkNd6NKUZAAM
Scope	PR #4010; nine changed files; existing wiki edits excluded
Verification	154 tests passed, 21 skipped; workflow YAML/action references validated