ci: use bundled npm for trusted publishing

.github/workflows/release.yml

@@ -96,14 +96,17 @@ jobs:
         with:
           node-version: 24
           package-manager-cache: false
-      - name: Use current npm for trusted publishing
+      - name: Verify bundled npm supports trusted publishing
         run: |
           set -euo pipefail
-          NPM_VERSION=12.2.0
-          NPM_SHA256=6666b48816b39b86c3febac7b51a4ee4de6c5ca589c382ad8004b6b113f86677
-          curl -fsSL "https://registry.npmjs.org/npm/-/npm-${NPM_VERSION}.tgz" -o /tmp/npm.tgz
-          echo "${NPM_SHA256}  /tmp/npm.tgz" | sha256sum -c -
-          npm install -g /tmp/npm.tgz
+          node -e '
+            const { execFileSync } = require("node:child_process");
+            const version = execFileSync("npm", ["--version"], { encoding: "utf8" }).trim();
+            const [major, minor, patch] = version.split(".").map(Number);
+            if (major < 11 || (major === 11 && (minor < 5 || (minor === 5 && patch < 1)))) {
+              throw new Error("npm " + version + " does not support trusted publishing");
+            }
+          '
           echo "npm $(npm --version)"
       - name: Publish npm package
         working-directory: npm

CONTRIBUTING.md

@@ -14,6 +14,19 @@ cargo fmt --all --check
 
 All three must pass; CI enforces them.
 
+Development and test builds disable debug information and incremental compilation
+to keep `target/` small. Debug assertions and overflow checks remain enabled.
+For source-level debugging, opt in for one command:
+
+```bash
+CARGO_PROFILE_DEV_DEBUG=2 CARGO_PROFILE_TEST_DEBUG=2 CARGO_INCREMENTAL=1 cargo test --workspace
+```
+
+Cargo retains old build variants. Use `cargo clean` when accumulated artifacts
+need clearing. In a linked worktree, reuse the primary checkout's cache with
+`CARGO_TARGET_DIR=/absolute/path/to/rtblint/target`. Run Cargo from the checkout
+being tested so it reads that checkout's configuration.
+
 ## Repo layout
 
 - `crates/rtblint-core`: the validation engine and embedded spec catalogs

Cargo.toml

@@ -18,3 +18,8 @@ authors = ["Aleks <aleks@vastlint.org>"]
 license = "Apache-2.0"
 repository = "https://github.com/aleksUIX/rtblint"
 homepage = "https://rtblint.org"
+
+# Tests inherit this profile. Keep routine builds small across release worktrees.
+[profile.dev]
+debug = 0
+incremental = false