[GSTJ]

Summary

We now decide whether a release is due before checking publishing credentials. Dry runs can preview a release without npm access.

Details

• Reuses release-it's version planner and the existing conventional commit policy. The current history requires v2.0.2.
• Skips publishing for an empty plan and runs the installed security probes plus the audit gate before publishing.
• Keeps the existing annotated tag, release notes and version bump PR flow. Publishing still requires valid npm credentials.
• Covers no-op, patch, minor, breaking and forced plans with credentials cleared, an unreachable registry, and checks that previews leave commits, tags and package versions unchanged.

Testing steps

Run:

pnpm install --frozen-lockfile
pnpm test
pnpm run lint
pnpm run format
pnpm run typecheck
pnpm run build
pnpm run changelog:check
pnpm run security:check

All checks should pass. Dispatch Release with dry-run enabled and confirm it previews v2.0.2 without publishing or creating a tag.

Local logs, security review, SBOM and image proof.