[rogerchappel]

Summary

• Run the existing release workflow policy checker in the regular CI Node-check sequence, so pull requests and main pushes validate release workflows.
• The checker fails when the release workflow's required public provenance flag is removed (verified with a temporary invalid workflow fixture, then restored).

Verification

• npm ci
• npm run release:workflow-check
• npm test (45 passing)
• npm run check
• npm run build
• npm run smoke
• npm run package:smoke
• git diff --check
• Negative fixture: temporarily removed --provenance from release workflow; checker exited non-zero on its policy assertion. Restored file and re-ran checker successfully.

Risk Level

• Low

Rollback Plan

• Remove the release:workflow-check CI invocation.

Human Decision Needed

• None