[joeblau]

Prepares HIG 0.1.0 for npm publication from the self-hosted Mac minis. Nothing is published, tagged or released by this PR.

publish.yml

• Runs on [self-hosted, macOS, ARM64]. No GitHub-hosted runners.
• Triggered by a published GitHub release with a v* tag, or by workflow_dispatch with a required tag input. Checks out refs/tags/<tag>.
• Publishes with the org NPM_TOKEN secret (NODE_AUTH_TOKEN via setup-node registry-url). Removes OIDC (id-token: write), --provenance, the npm-release environment and the reviewer/quality-run prerequisites job. The job re-runs every gate on the tag commit itself.
• Keeps check → quality → release:dry-run --channel stable-simulation → verify-release.mjs → publish → smoke:registry. Publishes in dependency order and skips versions that are already published, so an interrupted run can be resumed. The registry hash check still catches byte mismatches.
• No actions/cache and no setup-node cache:. Fonts are generated fresh with scripts/ci-generate-fonts.sh. No global npm install on the shared minis. playwright install chromium without --with-deps.

Other changes

• scripts/registry-smoke.mjs: drops the npm provenance-attestation assertions, because token publishing has no attestations. Keeps the tarball SHA-256 equality and consumer smokes.
• tests/ci-runners.test.ts: now also covers publish.yml (self-hosted macOS only, no apt/sudo/--with-deps).
• Docs (docs/governance/release.md, docs/ci-runners.md, plus regenerated docs output) updated to describe the new mechanism.
• planning/release-blockers.json: updates the wording of the task-policy reason only. No blocker status changed.
• New CHANGELOG.md with the 0.1.0 entry.

Versions

The root package and all eight packages (@bloxwap/hig-chart, -contracts, -feedback, -native, -native-fonts, -og-fonts, -react, -tokens) and their internal ranges were already 0.1.0 on main. No bump was needed.

Local validation (Linux box)

npm ci, font generation, npm run check (172 web + 169 native tests), npm run quality, release:dry-run --channel stable-simulation (8 artifacts) and actionlint all pass. verify-release fails as expected with Release gates remain: task-policy, source-audit, native-fonts, physical-devices, owning-migrations, upstream-feedback-gaps. Publishing needs those gates cleared, or approved as exceptions by the owner, first.