feat(publish)!: select one publication gate by default

[svyatov]

What changed

• Select one publication gate by default for each release flow.
• Use npm staged approval for one package and one forge gate for packages released together.
• Use a forge gate with automatic Maven Central publication.
• Use one protected blocking manual job on GitLab.
• Preserve established extra gates until the maintainer accepts a migration.
• Add source records and regression tests for the new policy.

A fresh oss-publish run against botchart under Codex with GPT-5 exposed the problem. Its two npm packages release together. The generated flow required one GitHub approval and two npm approvals. The first staged publish also failed because npm read package/*.tgz as GitHub shorthand.

Why this way

A publication gate must stop CI from making the release public. It must also cover every package in the release flow with one action.

npm staged publishing meets both conditions for one package. npm creates one stage per package, so a coordinated multi-package release uses one forge gate.

Maven Central uses the same user token for upload and publish API calls. A USER_MANAGED deployment cannot protect publication from CI that holds the token. The forge gate protects the token, and Central publishes automatically after approval.

GitLab deployment approval rules require a later manual job start. A protected blocking manual job provides one action.

Verification

• bun run typecheck
• bun test, 327 tests passed
• bun run validate, 0 errors and 0 warnings
• bash tests/test-check-drift.sh, 12 tests passed
• bash scripts/check-drift.sh
• bun scripts/check-ecosystems.mjs, 11 ecosystems x 7 skills present
• skillspector scan ./skills/ --no-llm --format json
• bun run build in site/, 114 pages built
• git diff --check

Affects

Rule or skill	Change
R-PUB-02	Maven Central credentials must become available after a native forge gate
R-PUB-04	At least one gate is required, and extra gates remain valid
oss-publish	One gate is selected by default for each release flow

BREAKING CHANGE: R-PUB-02 now requires Maven Central credentials to become available only after a native forge publication gate.