fix(release): require CI and test the final npm tarball

[dinakarjs]

Release builds currently run independently of the CI matrix, and npm validation checks the source tree before packing. Reuse the full CI workflow before building, and install the final npm tarball into a fresh consumer directory before uploading that same artifact for publication. Failed, cancelled or skipped validation blocks both publishers.

The installed-package checks cover public imports and module origin, package identity/version and declarations, all shared valid/invalid conformance fixtures, and golden event construction. CI exercises this packed consumer path on pull requests too. Both registry publishers and release assets retain their existing artifact handoff and protected environments.

Scope: approved ruling in agentrust-io/.github#54. @imran-siddique, please review.

Validation:

• Python unittest suite: 145 run, 143 passed, 2 skipped (PyYAML-dependent checks; actionlint passed separately). Local Python 3.12.14. OTEL_TRACES_SAMPLER=always_on matched the suite's in-memory recording assumptions; the workspace's inherited ratio sampler caused the initial three OTel failures.
• TypeScript build and all 44 tests passed on Node 24.19.0, plus npm dry-run packaging. The local tsx CLI could not open its IPC socket; the equivalent node --import tsx --test invocation passed.
• Installed final tarball: four checks passed. Tarball mutants with missing schemas, a wrong version, always-accept validation and always-reject validation were caught.
• Release guard mutants removing validation or the tarball check were caught; version/schema/OTel compatibility gates, conformance runner, compileall, actionlint and whitespace checks passed.

Other Python versions and Node 20 require GitHub CI. No release dispatch, publication or environment/reviewer setting changes were performed. Local tarballs were created solely to validate the proposed packaging check.

Signed-off-by: Srinivasa Dinakar dinakarjs@gmail.com

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[imran-siddique]

Reviewed ebfb212 against the two approved gaps in agentrust-io/.github#54. The reusable CI matrix is a prerequisite for build, so failed/cancelled/skipped validation blocks both publishers. The npm smoke check installs the final tarball outside the checkout, checks public imports and declarations, exercises valid/invalid schema controls and golden event construction, and leaves publication using that same uploaded artifact.

Validation: all 3 release-safeguard tests passed locally. Inspected CI job 112185144861: 44 TypeScript tests and all 4 installed-tarball checks passed. The Python 3.10–3.13 matrix and workflow lint are green. No release workflow was dispatched.