fix(release): publish exact tested archives

[drewstone]

Summary

• create one Runtime or Agent Bench archive in a credential-free job
• run consumer checks against that exact archive and record its SHA-256
• publish only the downloaded archive from a minimal Node 24 job
• remove checkout, dependency installation, builds, and package lifecycle scripts from jobs that can mint npm credentials
• enforce the split in CI and disable persisted checkout credentials

Proof

• Runtime tests: 1,856 passed, 6 skipped, 0 failed
• Runtime typecheck and lint passed
• production audit: 0 known vulnerabilities
• package checks: publint, package types, static imports, packed consumer, and Worker execution passed
• exact Runtime archive: packed consumer and Worker execution passed
• exact Agent Bench archive: installed consumer passed with TypeScript 5.9.3 and 6.0.3
• workflow checks: actionlint passed
• policy check: accepts the release workflow and rejects an injected checkout in a publish job
• frozen pnpm install and diff checks passed

This PR intentionally lands before tagging Runtime 0.109.1 so the release uses the isolated publishing path.

[tangletools]

✅ Auto-approved drewstone PR — 23d2002f

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-29T02:44:14Z}