release: promote latest from CI after the npm approval (no maintainer CLI step) #422

Mirror of tpsdev-ai/flair's "release: promote latest from CI after the npm approval" for cli: today after the npm approval a maintainer runs scripts/promote-latest.sh <version> from a checkout. Replace it with a release-promote job (poll gate on "every published package <name>@<version> is downloadable", tarball sha256 preflight against the release run's certified set, npm dist-tag add for the set with NPM_TOKEN from a release-promote environment restricted to v* tag refs, no repository code checked out under the token, skew check after). cli has no canary; the install-from-tarball smoke that already runs in CI is the gate. One human action per release: the npm approval on the phone. Nathan 2026-09-26.