fix(release): unblock npm publish — remove broken kit install, add payment ext

[jamesnrokt]

Context

The 4.0.0 release (run) partially published: @mparticle/cordova-sdk@4.0.0 reached npm, then the workflow failed at "Install Rokt Kit dependencies". The Rokt kit never published, and no git tag or GitHub release was created.

Root cause

release-from-main.yml ran npm ci in Kits/Rokt. npm ci requires a package-lock.json. That lock file was intentionally removed (the kits are dependency-less and carry no lock), so npm ci failed with EUSAGE.

Changes

1. Remove the Rokt kit install step entirely. The kits have no dependencies and no lifecycle scripts, so npm publish packs and uploads on its own — there is nothing to install. (The npm ci was cargo-culted from the plugin's step, where it is needed to run tests + build.)
2. Add the Kits/RoktPaymentExtension publish step. It's new in 4.0.0 with publishConfig, but the workflow had no step for it, so it was never published to npm.

Recovery plan

We will not re-run 4.0.0. Roll forward to 4.0.1 through the normal flow:

1. Merge this PR (workflow-only — does not touch VERSION, so it won't trigger a release).
2. Dispatch draft-release-publish.yml with a patch bump → opens the 4.0.1 release PR.
3. Merge that PR → VERSION changes → release-from-main.yml publishes all three packages at 4.0.1 and cuts tag 4.0.1 + the GitHub release.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes production release automation and npm publish behavior; mistakes could affect which packages ship or how tags/releases are updated, though idempotent skips reduce duplicate-publish risk.

Overview
Repairs the Release NPM workflow so a failed 4.0.0 run can be finished without republishing packages that already shipped.

Rokt kits now use npm install instead of npm ci, matching lockless kit packages. Install + publish steps were added for Kits/RoktPaymentExtension, which the release path had never published. Every npm publish step is idempotent: it checks the registry and skips when that exact version already exists.

The workflow can be started manually via workflow_dispatch, and the GitHub release step sets allowUpdates: true so re-runs can update an existing release/tag.

^{Reviewed by Cursor Bugbot for commit a8df4db. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

This PR updates the release workflow to safely recover from the partially-published 4.0.0 release by enabling manual reruns, making npm publishes idempotent, and ensuring the Rokt kit(s) can install/publish without requiring lockfiles.

Changes:

• Add workflow_dispatch and set GitHub release creation to allowUpdates: true for safe reruns.
• Make npm publishes idempotent by skipping packages whose exact version is already on npm.
• Switch Kits/Rokt from npm ci to npm install, and add install/publish steps for Kits/RoktPaymentExtension.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.