[anilkreddy]

Prepare the required @commercekit-tools/notification-contract@0.0.4 preview
publication for the already merged cleanup-event extension (#10).
Published 0.0.3 is immutable and lacks the event/factory, so Notify cannot build
against it. ccv2-client remains 0.0.3; no client/auth/transport code changes.

Changes: selected-package manifest/changelog and current-source documentation;
release-safety assertions for independently versioned packages; packed-install
smoke checks importing, validating and typechecking createBuildCleanupEvent
and BuildCleanupEvent through public exports. No runtime/schema behavior is
changed from merged main, no dependency ranges or registry provenance are faked.

Validation using Node24.21.0/pnpm12.6.0:

• Frozen installation, complete pnpm quality PASS.
• 277 tests PASS; coverage 99.65% statements,99.10% branches,97.91% functions,
  100% lines under unchanged existing thresholds.
• Builds, all compatibility adapters/fixtures, installed-tarball imports/schema/
  declarations/export-boundaries, public scan and dependency audit PASS.
• Selected 0.0.4 tarball independently packed, installed and checked, including
  the new cleanup API. Local SHA256:
  02807ee404e55d3b523f855680f2fbb9e2630246604faed68a4d50bf8ab9a436.
• Registry checks: 0.0.3 exists; 0.0.4 absent. The publication workflow repeats
  absence and immutability verification using its package-authorized token.

The owner explicitly authorized publishing the required contract and upgrading
Notify #17. Merge only after
fresh quality/platform/CodeQL checks pass. After merge, verify exact-main checks
and complete clean main CodeQL evidence, then dispatch only publish-package.yml
for notification-contract/preview with its required confirmation. That workflow
retests and publishes the exact checksum-verified tarball it validated.

No release-tag/GitHub Release workflow, ccv2-client publication, deployment,
webhook delivery, or real SAP deletion/enablement is authorized. Package
publication is separate from tag creation. Notify will use the actual registry
version with a regenerated exact lockfile/bundle, then merge only after green CI.

Authorized publication completed

Published @commercekit-tools/notification-contract@0.0.4 through the existing
package-only workflow
from exact main a03da9366e6483040d504a742c1a95413c1202cb, after exact-main
CI/platform/CodeQL checks and complete clean analysis passed. The workflow
retested, packed, checked and published the exact reviewed bytes.

Registry verification passed with integrity
sha512-y1kTB/s049V0DGLoQZd4s+vlFscShG5wS5g2H4WH6t6rRSOuJrKiCy42dcNlx5wC7NAy6hQuYoTFOQVQ1+PVoA==
and tarball SHA-256
02807ee404e55d3b523f855680f2fbb9e2630246604faed68a4d50bf8ab9a436.
The before/after Git tag lists are identical; no GitHub Release/tag workflow
was dispatched. ccv2-client was not published. Notify #17 is being upgraded
against the actual registry version with fresh validation before merge.