[Be1newinner]

Problem

The first Release run (from #21) failed at npm publish with E404. The trusted publisher on npm is configured stage-only, as npm recommends: it doesn't allow direct npm publish. npm reports a rejected publish as a 404.

This fix was pushed to #21's branch after #21 had already merged, so it never reached main. That run failed before tagging, so nothing was published or tagged. npm still shows latest: 3.0.0.

Fix

• Stage instead of publish: releases now use npm stage publish, which trusted publishers are always allowed. Nothing goes live until the maintainer approves it on npmjs.com, with 2FA.
• Newer npm: the workflow upgrades to npm 11, since npm stage needs 11.15 or newer.
• Tag and draft release: when a version is staged, it gets a vX.Y.Z tag and a draft GitHub release. The job summary explains how to approve or reject.
• Pending approvals: the previous release is now the highest of npm's version and the v* tags. A push made while a release is still waiting stages the next patch instead of failing, since npm can't stage the same version twice.
• Docs: CONTRIBUTE.md documents approving (Staged Packages tab, or npm stage approve <id>) and rejecting.

The versioning rules are unchanged: patch is automatic, minor needs the maintainer's manual run, major is never automated.

After merging

• The merge stages 3.0.1. Approve it on npmjs.com, on the package's Staged Packages tab.
• To release 3.1.0 instead, reject the staged 3.0.1 and run the Release workflow with bump: minor.

Test plan

• Version script on this branch: 3.0.0 → 3.0.1
• Scratch-clone test: a push while v3.0.1 is staged but npm still says 3.0.0 → 3.0.2
• npm stage publish --dry-run --access public accepts the flags and packs the same 67 files
• The first real staged release, after merging

🤖 Generated with Claude Code

https://claude.ai/code/session_015pLhuJbdhCyvDro7o6h1wp