ci: harden release provenance and Darwin x64 verification

[roodboi]

Summary

• scope id-token: write to the GitHub-hosted npm publication job
• leave every Blacksmith-hosted job outside the OIDC minting boundary
• add a macOS Intel compiled-binary verifier to pre-merge CI

Why

Current main already moves npm publication to a GitHub-hosted runner. This follow-up closes the remaining trust-boundary issue identified in review and makes the exact Intel compiled verifier that caught two partial releases a required pull-request signal.

The commit uses the non-release ci: type: it hardens delivery without creating an unnecessary package version after the current release finishes.

Verification

• bun run type-check
• bun run check
• git diff --check
• changed-public-surface privacy scan
• hosted normal CI plus macOS 15 Intel build/verify on this exact head

Local timing-sensitive suites remain deferred to hosted CI because the development host is saturated; no unrelated runtimes were paused or terminated.

[roodboi]

@codex review

Please review exact head b96e8ae7ba85b921f051bb0d90b778d3201b5cd7, with particular attention to Darwin x64 FFI ABI matching, cross-architecture symbol selection, and whether the hosted Intel verifier closes the release gap.

[roodboi]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: b96e8ae7ba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[roodboi]

@codex review

Please review exact rebased head 367aea7b1a84785d0ff29ccb9d71c2524b94a7a0. The prior reviewed head passed Intel verification; this head preserves the v2.25.2 refactor and selects the matching $INODE64 family for all three directory-stream operations.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 367aea7b1a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[roodboi]

@codex review

Please review exact head e04fdf9 for the npm provenance trust boundary and the new macOS Intel pre-merge verifier. This head contains workflow changes only.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e04fdf9c09

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[roodboi]

@codex review

Please review exact head a97d9a4, including the job-scoped OIDC permission fix for your prior P2.

[roodboi]

@codex review

Please review exact current-main head 173396a. This workflow-only diff preserves the landed GitHub-hosted npm runner, narrows OIDC permission to that job, and adds Intel pre-merge verification.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 173396a91e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[roodboi]

Superseded by merged PRs #67, #68, and #69. The Darwin x64 ABI fix, GitHub-hosted npm provenance publish, macOS Intel pre-merge verifier, and job-scoped OIDC permissions are all now on main and verified. Closing this conflicting umbrella branch to avoid duplicate work.