GitHub releases are created only by the changesets/action step, and that step
has not completed cleanly on any release-triggering run since mid-June (last
release: @tanstack/ai-react@0.15.5 on 2026-06-15; npm is now at 0.15.12).

The "Version Packages" merge runs (#773, #778, #787, #792, #808, #813) passed
the test gate and then FAILED at the "Run Changesets" step: CI ran
`changeset publish` and npm advanced, but the step died before the tag-push /
GitHub-release phase, so no tags (0.15.6-0.15.12 don't exist) and no releases
were created. More recent runs (#814, #825) now fail even earlier, at the test
gate (test:kiira), so the changesets step is never reached. Either way npm and
GitHub drift apart. (The exact in-step error is no longer recoverable - those
runs' logs have expired.)

Changes:
- Split into a `test` gate job and a `release` job (needs: test) so a flaky run
  blocks BOTH npm and GitHub releases together, never one without the other.
- Add workflow_dispatch so a maintainer recovers a blocked release by re-running
  the workflow (publish is idempotent) instead of intervening by hand.
- Add a self-heal step that enforces "published to npm => GitHub release exists":
  for any package version on npm without a release it creates the tag + release
  from the CHANGELOG. Runs even when the changesets step fails mid-way and on
  manual re-runs, so gaps self-heal - directly covering the failure mode above.
- Set GITHUB_TOKEN explicitly on the changesets step and tighten permissions
  (top-level contents:read; write scoped to the release job).

GitHub releases are created only by the changesets/action step, and that step
has not completed cleanly on any release-triggering run since mid-June (last
release: @tanstack/ai-react@0.15.5 on 2026-06-15; npm is now at 0.15.12).

The "Version Packages" merge runs (#773, #778, #787, #792, #808, #813) passed
the test gate and then FAILED at the "Run Changesets" step: CI ran
`changeset publish` and npm advanced, but the step died before the tag-push /
GitHub-release phase, so no tags (0.15.6-0.15.12 don't exist) and no releases
were created. More recent runs (#814, #825) now fail even earlier, at the test
gate (test:kiira), so the changesets step is never reached. Either way npm and
GitHub drift apart. (The exact in-step error is no longer recoverable - those
runs' logs have expired.)

Changes:
- Split into a `test` gate job and a `release` job (needs: test) so a flaky run
  blocks BOTH npm and GitHub releases together, never one without the other.
- Add workflow_dispatch so a maintainer recovers a blocked release by re-running
  the workflow (publish is idempotent) instead of intervening by hand.
- Add a self-heal step that enforces "published to npm => GitHub release exists":
  for any package version on npm without a release it creates the tag + release
  from the CHANGELOG. Runs even when the changesets step fails mid-way and on
  manual re-runs, so gaps self-heal - directly covering the failure mode above.
- Set GITHUB_TOKEN explicitly on the changesets step and tighten permissions
  (top-level contents:read; write scoped to the release job).

GitHub releases are created only by the changesets/action step, and that step
has not completed cleanly on any release-triggering run since mid-June (last
release: @tanstack/ai-react@0.15.5 on 2026-06-15; npm is now at 0.15.12).

The "Version Packages" merge runs (#773, #778, #787, #792, #808, #813) passed
the test gate and then FAILED at the "Run Changesets" step: CI ran
`changeset publish` and npm advanced, but the step died before the tag-push /
GitHub-release phase, so no tags (0.15.6-0.15.12 don't exist) and no releases
were created. More recent runs (#814, #825) now fail even earlier, at the test
gate (test:kiira), so the changesets step is never reached. Either way npm and
GitHub drift apart. (The exact in-step error is no longer recoverable - those
runs' logs have expired.)

Changes:
- Split into a `test` gate job and a `release` job (needs: test) so a flaky run
  blocks BOTH npm and GitHub releases together, never one without the other.
- Add a self-heal step that enforces "published to npm => GitHub release exists":
  for any package version on npm without a release it creates the tag + release
  from the CHANGELOG. Runs even when the changesets step fails mid-way, so gaps
  self-heal on the next release run - directly covering the failure mode above.
- Set GITHUB_TOKEN explicitly on the changesets step and tighten permissions
  (top-level contents:read; write scoped to the release job).

GitHub releases are created only by the changesets/action step, and that step
has not completed cleanly on any release-triggering run since mid-June (last
release: @tanstack/ai-react@0.15.5 on 2026-06-15; npm is now at 0.15.12).

The "Version Packages" merge runs (#773, #778, #787, #792, #808, #813) passed
the test gate and then FAILED at the "Run Changesets" step: CI ran
`changeset publish` and npm advanced, but the step died before the tag-push /
GitHub-release phase, so no tags (0.15.6-0.15.12 don't exist) and no releases
were created. More recent runs (#814, #825) now fail even earlier, at the test
gate (test:kiira), so the changesets step is never reached. Either way npm and
GitHub drift apart. (The exact in-step error is no longer recoverable - those
runs' logs have expired.)

Changes:
- Split into a `test` gate job and a `release` job (needs: test) so a flaky run
  blocks BOTH npm and GitHub releases together, never one without the other.
- Add a self-heal step that enforces "published to npm => GitHub release exists":
  for any package version on npm without a release it creates the tag + release
  from the CHANGELOG. Runs even when the changesets step fails mid-way, so gaps
  self-heal on the next release run - directly covering the failure mode above.
- Set GITHUB_TOKEN explicitly on the changesets step and tighten permissions
  (top-level contents:read; write scoped to the release job).

…lege

GitHub releases are created only by the changesets/action step, and that step
has not completed cleanly on any release-triggering run since mid-June (last
release: @tanstack/ai-react@0.15.5 on 2026-06-15; npm is now at 0.15.12).

The "Version Packages" merge runs (#773, #778, #787, #792, #808, #813) passed
the test gate and then FAILED at the "Run Changesets" step: CI ran
`changeset publish` and npm advanced, but the step died before the tag-push /
GitHub-release phase, so no tags (0.15.6-0.15.12 don't exist) and no releases
were created. More recent runs (#814, #825) now fail even earlier, at the test
gate (test:kiira). (The exact in-step error is no longer recoverable - those
runs' logs have expired.)

Changes:
- Split into a `test` gate job and a `release` job (needs: test) so a flaky run
  blocks BOTH npm and GitHub releases together, never one without the other.
- Set GITHUB_TOKEN explicitly on the changesets step.
- Tighten permissions: top-level contents:read; write scoped to the release job.

GitHub releases are created only by the changesets/action step, and that step
has not completed cleanly on any release-triggering run since mid-June (last
release: @tanstack/ai-react@0.15.5 on 2026-06-15; npm is now at 0.15.12).

The "Version Packages" merge runs (#773, #778, #787, #792, #808, #813) passed
the test gate and then FAILED at the "Run Changesets" step: CI ran
`changeset publish` and npm advanced, but the step died before the tag-push /
GitHub-release phase, so no tags (0.15.6-0.15.12 don't exist) and no releases
were created. More recent runs (#814, #825) now fail even earlier, at the test
gate (test:kiira). (The exact in-step error is no longer recoverable - those
runs' logs have expired.)

Changes:
- Split into a `test` gate job and a `release` job (needs: test) so a flaky run
  blocks BOTH npm and GitHub releases together, never one without the other.
- Tighten permissions: top-level contents:read; write scoped to the release job.

…aps (#829)

ci: gate release on a separate test job, least-privilege permissions

GitHub releases are created only by the changesets/action step, and that step
has not completed cleanly on any release-triggering run since mid-June (last
release: @tanstack/ai-react@0.15.5 on 2026-06-15; npm is now at 0.15.12).

The "Version Packages" merge runs (#773, #778, #787, #792, #808, #813) passed
the test gate and then FAILED at the "Run Changesets" step: CI ran
`changeset publish` and npm advanced, but the step died before the tag-push /
GitHub-release phase, so no tags (0.15.6-0.15.12 don't exist) and no releases
were created. More recent runs (#814, #825) now fail even earlier, at the test
gate (test:kiira). (The exact in-step error is no longer recoverable - those
runs' logs have expired.)

Changes:
- Split into a `test` gate job and a `release` job (needs: test) so a flaky run
  blocks BOTH npm and GitHub releases together, never one without the other.
- Tighten permissions: top-level contents:read; write scoped to the release job.