Harden release follow-up verification

[Ismail-elkorchi]

Summary

• give the artifact-only release-notes publishing job explicit GitHub repository identity
• model delayed npm attestation availability as a transient registry state
• replace duplicated fixed-attempt shell loops with bounded exponential backoff that stops immediately on immutable mismatches
• add regression coverage for no-checkout repository resolution, transient provenance, immutable mismatches, backoff, and workflow wiring

Causes

The release-notes publishing job runs without a checkout, but its gh release edit invocation omitted --repo, so GitHub CLI attempted repository discovery through .git and failed.

npm accepted the exact qualified tarball and produced correct SLSA provenance, but the attestation endpoint returned HTTP 404 for longer than the fixed 55-second post-publish loop. The verifier treated that expected propagation state as an exception and retried all failures indiscriminately.

Validation

• focused release and registry tooling tests
• npm run check:fast
• ESLint
• actionlint
• diff whitespace validation
• live npm metadata and decoded SLSA provenance confirm the published integrity, workflow, release event, tag, GitHub-hosted builder, and exact source commit