ci(release): make engine npm-publish opt-in; keep GitHub Release binaries (#162)

`@opencoven/coven-code` is deprecated — the engine now ships as a GitHub
Release binary that `coven` installs and pins. So npm publishing must never
be automatic:

- release.yml: add a `publish_npm` input (default false) and gate the
  npm-publish dispatch on it. Default releases produce binaries + checksums
  only.
- npm-publish.yml: drop the `workflow_run: [Release]` auto-trigger (it would
  otherwise fire on any Release completion and republish the deprecated
  package, undoing the deprecation). Now workflow_dispatch-only; release.yml
  invokes it explicitly only when publish_npm=true. Removed the now-dead
  workflow_run checkout branch.

Author: BunsDev

.github/workflows/npm-publish.yml

@@ -7,32 +7,24 @@ on:
         description: 'Version to publish (e.g., v0.1.1). Must already exist as a GitHub Release.'
         required: true
         type: string
-  workflow_run:
-    workflows: ['Release']
-    types: [completed]
 
 permissions:
   contents: read
   id-token: write
 
-# Belt-and-suspenders: release.yml dispatches us explicitly because
-# `workflow_run` is unreliable when the upstream `Release` run was itself
-# triggered by a GITHUB_TOKEN workflow_dispatch. If both paths happen to
-# fire for the same release, this static concurrency group serializes them
-# and the second run exits cleanly when the version is already on npm.
-# Releases are version-monotonic so blanket serialisation is safe; there
-# isn't a scenario where two concurrent publishes should both succeed.
+# Manual-only. `@opencoven/coven-code` is deprecated — the engine ships as a
+# GitHub Release binary that `coven` installs and pins, so npm publishing is
+# never automatic. release.yml dispatches this workflow explicitly only when
+# its `publish_npm` input is set to true; the version must already exist as a
+# GitHub Release. The static concurrency group still serializes any overlapping
+# manual runs, and a second run exits cleanly when the version is already on npm.
 concurrency:
   group: npm-publish
   cancel-in-progress: false
 
 jobs:
   npm-publish:
-    if: >-
-      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') ||
-      (github.event_name == 'workflow_run' &&
-       github.event.workflow_run.conclusion == 'success' &&
-       github.event.workflow_run.head_branch == 'main')
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     name: Publish coven-code to npm
 
@@ -55,17 +47,10 @@ jobs:
           echo "tag_ref=refs/tags/v$VERSION" >> "$GITHUB_OUTPUT"
 
       - uses: actions/checkout@v5
-        if: github.event_name == 'workflow_dispatch'
         with:
           ref: ${{ steps.requested_version.outputs.tag_ref }}
           fetch-depth: 0
 
-      - uses: actions/checkout@v5
-        if: github.event_name == 'workflow_run'
-        with:
-          ref: ${{ github.event.workflow_run.head_sha }}
-          fetch-depth: 0
-
       - name: Resolve version
         id: version
         env:

.github/workflows/release.yml

@@ -7,6 +7,11 @@ on:
         description: 'Version tag (e.g., v0.1.0)'
         required: true
         type: string
+      publish_npm:
+        description: 'Also publish @opencoven/coven-code to npm. The package is deprecated (engine ships as a GitHub Release binary) — leave false unless intentionally re-publishing.'
+        required: false
+        type: boolean
+        default: false
 
 # Only one release at a time — prevent races on the same tag.
 concurrency:
@@ -393,6 +398,7 @@ jobs:
       # deterministic — the workflow_run trigger stays as a manual-release
       # fallback.
       - name: Dispatch npm-publish.yml
+        if: ${{ inputs.publish_npm }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |