Prepare owner-authorized Components 4 publication

[woksin]

Context

The Components 4 source line has a fail-closed source-candidate contract. The repository can generate seven immutable archives, SHA-256/SHA-512 manifests, and seven archive-bound CycloneDX SBOMs, but .github/workflows/publish.yml intentionally has no publication capability. Source readiness does not authorize registry or release operations.

This issue begins only when repository owners explicitly authorize publication work.

Required owner/admin decisions

• Approve the final seven-package GA scope and package versions.
• Set and approve the Components 3 eolAt date and maintenance branch policy.
• Create the five npm package records that do not yet exist.
• Configure npm trusted publishers for all seven packages.
• Create a protected GitHub npm environment with required human reviewers and a main-only rule.
• Approve the non-default candidate dist-tag and final promotion order.
• Approve tag-signing/protection and final release notes.

Workflow direction

Implement a separate manual-only publisher after the decisions above:

1. Accept only an exact reviewed main commit and expected package versions.
2. Install immutably and consume the exact retained release-evidence archives; never rebuild between verification and publication.
3. Grant contents: read and id-token: write only to the publish job.
4. Bind the job to the protected npm environment. Never auto-approve it.
5. Publish under a non-default candidate tag, tooling/Conformance/adapters first and Core last, stopping on the first failure.
6. Verify package identity, visibility, tarball SHA-512, SBOM, provenance, exports, and exact-version consumers from the registry.
7. Promote dist-tags manually only after all seven candidates pass.
8. Create the Git tag and GitHub release only after registry verification.

Acceptance criteria

• compat-manifest.json is deliberately changed to publication-authorized status with an owner-approved Components 3 EOL date.
• Every npm package exists, is public, and has the exact trusted-publisher configuration.
• The manual workflow is SHA-pinned, least-privilege, human-approved, stop-on-failure, and publishes retained bytes without rebuilding.
• Candidate registry artifacts match release-evidence SHA-512/SBOM/provenance.
• Final dist-tags, tag, and GitHub release are created only after all checks pass.
• No Plain or Storybook package is published.

Non-goal

Opening or implementing this issue does not itself authorize a publication run. The actual run still requires an explicit owner approval at the release checkpoint.

[woksin]

Components 4.0.0 was published successfully for all seven public packages with npm provenance. Release workflow recovery completed in #222, #224, and #226.