test(ci): validate non-manual release channels

[aram-devdocs]

Spec

Related issues: #51, #52

Summary

• tighten release/install validation so cargo and curl are explicitly documented and enforced as the current non-manual channels
• keep Homebrew and npm in prep-only/gated state with stronger validator checks and no tap/npm/secrets/publish wiring
• refresh v0 release-readiness wording so chore(main): release 0.0.2 #101 is treated as first-release evidence, not as stale pre-Gate-1 wording

Test plan

• bash tests/install-smoke-validate.sh
• bash tests/release-security-validate.sh
• bash tests/release-readiness-matrix-validate.sh
• git diff --check
• bash tests/release-readiness-local-kits-validate.sh in this shell (cargo is not installed in the current environment)

Screenshots / terminal output

N/A

Breaking change?

• No
• Yes — describe the migration path

Anything reviewers should double-check

• The new assertions intentionally preserve feat(release): plumb-dev/homebrew-tap + cargo-dist wiring #51/feat(release): @plumb npm org + @plumb/cli wrapper package #52 as open prep-only issues: no tap repo setup, no npm org/package setup, no secrets, no publish wiring.

[github-actions]

Now I have everything I need. Let me write the review.

---

PR 200 — test(ci): validate non-manual release channels

Touched buckets: ci, docs, tests

No Rust code changed. All Plumb Rust-specific blockers (determinism, layer discipline, unsafe, unwrap/expect, println!, todo!, HashMap in outputs) are not applicable.

---

1. Determinism — N/A

No plumb-core or library code touched.

2. Workspace layering — N/A

No crate boundaries crossed.

3. Error handling — N/A (shell scripts)

Scripts use set -euo pipefail. The || true guards on grep -c correctly suppress the grep exit-1-on-no-match. The fail() accumulator (failures=1, checked at EOF) is the right shape for a full-run validator.

4. Test coverage

All three new validators are wired in .github/workflows/ci.yml:38-42 — they run on every PR.

All checked strings verified present in the repo:

• docs/src/ci/release-prep.md — Issue #51 is prep-only… ✓, Issue #52 is also prep-only… ✓, both Until those blockers… strings ✓
• dist-workspace.toml — installers = ["shell", "powershell"] ✓, Issues #51 and #52 are intentionally prep-only ✓
• .github/workflows/install-smoke.yml — cargo×3, curl×3, brew×2, npm×3, One or more non-gated install channels failed. ✓
• .github/workflows/release.yml — all three grep targets ✓

5. Documentation — N/A (no docs/src/ prose change, no Rustdoc)

---

Punch list

tests/install-smoke-validate.sh:103-131 — undocumented magic numbers (warning)
cargo_count=3, curl_count=3, brew_count=2, npm_count=3 have no inline explanation for why brew is 2 (mac + Linux; Windows runner not supported for Homebrew) and npm is 3 (all OSes but gated). When the OS matrix next changes these counts will produce cryptic failures. A one-line comment per assertion is all that's needed.

tests/install-smoke-validate.sh:123-125 — misleading pass message (warning)

pass "npm channel stays limited to supported gated OS legs"

3 = all three OSes. "Stays limited" implies fewer than all. A message like "npm channel covers all 3 OSes as gated legs" matches the intent.

tests/release-security-validate.sh:197-203 and 222-227 — inconsistent absent-file behavior (warning)
The pre-existing check at ~line 193 passes when dist-workspace.toml is absent (treating absence as "Homebrew correctly absent"). The two new checks fail when the file is absent because [ -f "$DIST_CONFIG" ] && grep … short-circuits to the else branch. In practice harmless — the file must exist for cargo dist — but a future reader will be confused by the two opposite conventions in the same script.

---

No blockers. The contract being enforced is correct, the referenced strings are all present, and the CI wiring is complete.

Verdict: APPROVE