ci(publish): idempotent + transient-tolerant npm publish steps

A lockstep publish (v2.25.0) stranded mid-flight: run402-mcp published, then
`run402` hit a transient sigstore rekor TLOG timeout (TLOG_CREATE_ENTRY_ERROR),
failing the run before run402/@run402/sdk published and before the version-bump
commit/tag. A naive re-run would 409 on the already-published run402-mcp.

Each publish step now: retries transient provenance/network errors (rekor TLOG,
ECONNRESET, socket hang up) up to 3x, and treats "already published at this
version" as success — so a re-run after a partial publish completes the
remaining packages at the same lockstep version instead of failing on the one
that already landed. Any other error still fails loudly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: volinskey

.github/workflows/publish.yml

@@ -187,23 +187,85 @@ jobs:
           (cd "$SMOKE/sdk/package" && node -e "import('./dist/node/index.js').then(m => { if (typeof m.run402 !== 'function') { console.error('node run402 export is not a function'); process.exit(1); } console.log('SDK /node smoke OK'); }).catch(e => { console.error('Import failed:', e.message); process.exit(1); })")
           (cd "$SMOKE/sdk/package" && node -e "import('./dist/index.js').then(m => { if (typeof m.Run402 !== 'function') { console.error('iso Run402 export is not a function'); process.exit(1); } console.log('SDK iso smoke OK'); }).catch(e => { console.error('Import failed:', e.message); process.exit(1); })")
 
+      # Idempotent + transient-tolerant publish. --provenance is optional under
+      # OIDC (provenance is generated implicitly) but makes intent explicit and
+      # fails loudly if OIDC isn't wired. The helper:
+      #   - retries transient provenance/network errors (sigstore rekor TLOG
+      #     timeouts, ECONNRESET) up to 3x — these stranded a lockstep publish
+      #     mid-flight once (run402-mcp published, run402 hit a rekor abort);
+      #   - treats "already published at this version" as success, so a re-run
+      #     after a partial publish completes the remaining packages and reaches
+      #     a consistent lockstep version instead of 409-ing on the one that
+      #     already landed;
+      #   - fails loudly on any other error.
       - name: Publish run402-mcp to npm
         if: ${{ !inputs.dry_run }}
-        # --provenance is optional under OIDC (provenance is generated
-        # implicitly), but the flag makes the intent explicit and would
-        # cause the publish to fail loudly if OIDC isn't actually wired
-        # — which is exactly what we want during the first few CI runs.
-        # --access public is redundant for these public packages but
-        # harmless and self-documenting.
-        run: npm publish --access public --provenance
+        run: |
+          publish_idempotent() {
+            local label="$1"; local attempt=0 out
+            while [ "$attempt" -lt 3 ]; do
+              attempt=$((attempt + 1))
+              if out=$(npm publish --access public --provenance 2>&1); then
+                echo "$out"; echo "[$label] published (attempt $attempt)"; return 0
+              fi
+              echo "$out"
+              if echo "$out" | grep -qiE "cannot publish over|previously published|EPUBLISHCONFLICT"; then
+                echo "[$label] already published at this version — idempotent skip."; return 0
+              fi
+              if echo "$out" | grep -qiE "TLOG_CREATE_ENTRY_ERROR|rekor\.sigstore\.dev|tlog entry|ETIMEDOUT|ECONNRESET|socket hang up|aborted"; then
+                echo "[$label] transient provenance/network error — retry $attempt/3"; sleep 10; continue
+              fi
+              echo "[$label] non-retryable publish error."; return 1
+            done
+            echo "[$label] exhausted retries."; return 1
+          }
+          publish_idempotent run402-mcp
 
       - name: Publish run402 to npm
         if: ${{ !inputs.dry_run }}
-        run: cd cli && npm publish --access public --provenance
+        run: |
+          publish_idempotent() {
+            local label="$1"; local attempt=0 out
+            while [ "$attempt" -lt 3 ]; do
+              attempt=$((attempt + 1))
+              if out=$( (cd cli && npm publish --access public --provenance) 2>&1); then
+                echo "$out"; echo "[$label] published (attempt $attempt)"; return 0
+              fi
+              echo "$out"
+              if echo "$out" | grep -qiE "cannot publish over|previously published|EPUBLISHCONFLICT"; then
+                echo "[$label] already published at this version — idempotent skip."; return 0
+              fi
+              if echo "$out" | grep -qiE "TLOG_CREATE_ENTRY_ERROR|rekor\.sigstore\.dev|tlog entry|ETIMEDOUT|ECONNRESET|socket hang up|aborted"; then
+                echo "[$label] transient provenance/network error — retry $attempt/3"; sleep 10; continue
+              fi
+              echo "[$label] non-retryable publish error."; return 1
+            done
+            echo "[$label] exhausted retries."; return 1
+          }
+          publish_idempotent run402
 
       - name: Publish @run402/sdk to npm
         if: ${{ !inputs.dry_run }}
-        run: cd sdk && npm publish --access public --provenance
+        run: |
+          publish_idempotent() {
+            local label="$1"; local attempt=0 out
+            while [ "$attempt" -lt 3 ]; do
+              attempt=$((attempt + 1))
+              if out=$( (cd sdk && npm publish --access public --provenance) 2>&1); then
+                echo "$out"; echo "[$label] published (attempt $attempt)"; return 0
+              fi
+              echo "$out"
+              if echo "$out" | grep -qiE "cannot publish over|previously published|EPUBLISHCONFLICT"; then
+                echo "[$label] already published at this version — idempotent skip."; return 0
+              fi
+              if echo "$out" | grep -qiE "TLOG_CREATE_ENTRY_ERROR|rekor\.sigstore\.dev|tlog entry|ETIMEDOUT|ECONNRESET|socket hang up|aborted"; then
+                echo "[$label] transient provenance/network error — retry $attempt/3"; sleep 10; continue
+              fi
+              echo "[$label] non-retryable publish error."; return 1
+            done
+            echo "[$label] exhausted retries."; return 1
+          }
+          publish_idempotent "@run402/sdk"
 
       - name: Commit version bump
         if: ${{ !inputs.dry_run }}