chore(release): unblock 5.3.0 — version lockstep sync + npm-publish chaining (#804)

Every semantic-release run was blocked at the prepublishOnly safety gate:
validate-publish.js (Check 5) requires .aiox-core/package.json to match the
root version, but semantic-release only bumps the root manifest. Fixes:

- scripts/sync-version-lockstep.js: syncs .aiox-core/package.json and
  compat/aiox-core/package.json (version + @aiox-squads/core dependency pin)
  to the target version. Idempotent, standalone-usable.
- .releaserc.json: @semantic-release/exec prepare step runs the sync with
  ${nextRelease.version} — the gate now passes inside the release run.
- semantic-release.yml: after a non-dry-run release, explicitly dispatch
  npm-publish.yml (stable, all) via gh workflow run — the GITHUB_TOKEN tag/
  release events do not chain workflows (anti-recursion); workflow_dispatch
  is the documented exception (same pattern as release.yml
  trigger-npm-publish). Requires the new actions:write permission.
- Version bump 5.2.9 -> 5.3.0 committed across the three manifests (repo
  convention: chore(release) bump PRs), so the chained npm-publish.yml can
  publish the legacy aiox-core wrapper at 5.3.0 from the committed tree.

Context: docs/handoffs (aiox-cockpit) 2026-07-11-env-normalization-
consolidation.md, Fase 4. The orphan v5.3.0 tag from the failed attempt was
deleted; baseline tag for semantic-release remains v5.2.8 (next: 5.3.0,
minor, driven by the feat commits in #800/#801).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: Pedrovaleriolopez

.aiox-core/install-manifest.yaml

@@ -7,8 +7,8 @@
 # - SHA256 hashes for change detection
 # - File types for categorization
 #
-version: 5.2.9
-generated_at: "2026-07-10T16:41:41.241Z"
+version: 5.3.0
+generated_at: "2026-07-11T16:43:33.419Z"
 generator: scripts/generate-install-manifest.js
 file_count: 1164
 files:
@@ -3837,7 +3837,7 @@ files:
     type: monitor
     size: 818
   - path: package.json
-    hash: sha256:d8dbe037240a366d545ca4259d2059e705b709706dcf2a18a5a52d9b543b7ed9
+    hash: sha256:b9b72ceb7aff3d535f0fbd573eb0f1e37872b115cf91ac5fae17188fea115a2c
     type: other
     size: 1445
   - path: product/checklists/accessibility-wcag-checklist.md

.aiox-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiox-squads/core-internal",
-  "version": "5.2.9",
+  "version": "5.3.0",
   "description": "Internal package manifest for AIOX framework — declares runtime dependencies consumed by scripts under .aiox-core/. This is NOT published independently; it ships inside @aiox-squads/core (the top-level package). Kept name-distinct from the parent (`-internal` suffix) to avoid npm registry confusion. Version follows the parent package.",
   "private": true,
   "main": "index.js",

.github/workflows/semantic-release.yml

@@ -46,6 +46,7 @@ permissions:
   issues: write
   pull-requests: write
   id-token: write
+  actions: write # chain npm-publish.yml via workflow_dispatch (legacy wrapper + workspace packages)
 
 jobs:
   # Release job - CI validation handled by branch protection rules
@@ -172,6 +173,21 @@ jobs:
             npx semantic-release
           fi
 
+      - name: Chain npm-publish (legacy wrapper + workspace packages)
+        if: inputs.dry_run != true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # The tag/release created by semantic-release uses GITHUB_TOKEN, which does
+          # NOT trigger npm-publish.yml's push/release triggers (GitHub Actions
+          # anti-recursion). workflow_dispatch via API is the documented exception —
+          # same pattern release.yml relies on in its trigger-npm-publish job.
+          # npm-publish.yml is idempotent (should_publish skips versions already in
+          # the registry), so dispatching after a no-release run is a safe no-op.
+          gh workflow run npm-publish.yml --ref main -f publish_mode=stable -f packages=all
+          echo "✅ npm-publish.yml dispatched (stable, all packages)"
+          echo "### 🔗 Chained npm-publish.yml (stable, all)" >> $GITHUB_STEP_SUMMARY
+
       - name: Release Summary
         if: success()
         run: |

.releaserc.json

@@ -34,6 +34,9 @@
     ["@semantic-release/npm", {
       "npmPublish": true
     }],
+    ["@semantic-release/exec", {
+      "prepareCmd": "node scripts/sync-version-lockstep.js ${nextRelease.version}"
+    }],
     "@semantic-release/github"
   ]
 }

compat/aiox-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiox-core",
-  "version": "5.2.9",
+  "version": "5.3.0",
   "description": "Compatibility wrapper for @aiox-squads/core.",
   "license": "MIT",
   "bin": {
@@ -15,7 +15,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@aiox-squads/core": "5.2.9"
+    "@aiox-squads/core": "5.3.0"
   },
   "engines": {
     "node": ">=18"

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiox-squads/core",
-  "version": "5.2.9",
+  "version": "5.3.0",
   "description": "Synkra AIOX: AI-Orchestrated System for Full Stack Development - Core Framework",
   "bin": {
     "aiox": "bin/aiox.js",
@@ -171,6 +171,7 @@
   },
   "devDependencies": {
     "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^10.0.1",
     "@types/jest": "^30.0.0",
     "@typescript-eslint/eslint-plugin": "^8.46.2",