fix: harden release publication pipeline

[iHildy]

Summary

Follow-up to #38 and failed runs 33342806687 and 33342807173.

• compare release-please string outputs explicitly and use the maintained, SHA-pinned action with one stable manifest configuration
• validate canonical full commit SHAs without OIDC before checking out release sources
• build, pack, and smoke the exact artifact without OIDC; publish only that artifact directly to the requested latest or next tag
• synthesize unique next.<run>.<attempt> versions so prereleases do not consume the final stable version
• keep the OIDC job checkout-free, script-free, and limited to artifact verification plus npm publish
• smoke the exact registry version after publication and document that immutable npm versions cannot be rolled back by the post-publish smoke
• remove mutable input setup, candidate promotion, tag resolution, and invalid reusable-job continue-on-error
• make dependency setup frozen and add workflow regression tests
• document that default ~/.agents sync can expose private instructions or skills and can be disabled

The design follows GitHub reusable workflow restrictions, npm trusted publishing, and release-please action outputs.

Verification

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 -color
• bun install --frozen-lockfile
• bun run check
• bun test — 107 passed
• bun run build
• npm pack --dry-run --json — opencode-synced@0.9.0, 43 entries
• live API probes accepted the exact open release-please PR SHA and the commit behind v0.9.0, while an advanced untagged main SHA is rejected for latest
• full isolated two-instance E2E passed init, push, link, second push, and pull; the ephemeral GitHub repository was deleted

The E2E retained its known warning: the second machine local AGENTS.md did not refresh without restart, but its local sync repository contained the second sentinel and replication was confirmed.

Release PR #38 follow-up

After this merges, release-please must refresh #38 against main. The generated notes still need a manual accuracy pass to:

• call out the Turso session backend added within fix: expand e2e coverage and docs for session sync compatibility #53
• state that ~/.agents is synced by default, can be disabled with includeAgentsDir: false, and may contain private material
• use /pull/<number> links for PRs fix: strip overrides removes keys missing from local config #50, feat: add isolated GitHub two-instance E2E workflow #52, fix: expand e2e coverage and docs for session sync compatibility #53, feat: sync skills directory by default #56, fix: for #69 (nice) resolveSmallModel truncated selectors when the model ID itself contained /, #70, fix: sync plural OpenCode config directories #71, and feat: support explicit non-GitHub Git remotes #73 while keeping issue links for issues such as stripOverrides restores base value when override key is missing from local config #49 and resolveSmallModel truncates model IDs containing slashes #69

Commit under review: 06fc12c.