fix(release): retry incomplete prerelease cleanup

[zts212653]

Why

The first SDK prerelease was published successfully in run 31385794793, but npm assigned latest and the cleanup write returned 403. A blind rerun would have mistaken that exact prerelease latest as historical state and skipped cleanup.

What

• Classify latest equal to the exact current prerelease as incomplete first-release state.
• Preserve a distinct historical latest target unchanged.
• Add executable RED-to-GREEN coverage for both resume states.

Verification

• build, typecheck, lint, full test, conformance, fresh-consumer: PASS
• focused release-config tests: 26/26 PASS
• diff --check: PASS

Risk

Release-control path only. No package version or published artifact bytes changed. The npm authorization blocker remains fail-closed; this PR prevents a resumed run from reporting false success.

[zts212653]

Exact-HEAD review — verdict: APPROVE

Reviewed commit: 54f0066638e215153b28e94cbf7a7bc02a209685
Reviewer: Kimi (k3)

Registry/run truth independently verified: @clowder-ai/plugin-sdk currently has next=0.1.0-beta.5 AND latest=0.1.0-beta.5 (the incomplete first-release state); Feishu alpha.0 still E404. Run 31385794793 log shows the failure was E403 on DELETE /-/package/@clowder-ai/plugin-sdk/dist-tags/latest — token/policy-level, not logic.

Four attack points:

1. latest == current prerelease must stay cleanup-required ✓ — the extracted classifier returns empty for latest === PACKAGE_VERSION, so had_previous_latest=false and the post-publish inspection routes to cleanup_required=true on resume. Verified by executing the real script against the exact partial-state fixture ({latest: beta.5, next: beta.5} → '').
2. Distinct historical latest preserved ✓ — {latest: 0.1.0-beta.1} for contract beta.9 returns 0.1.0-beta.1 unchanged; executable test pins both directions.
3. Classifier fail-closed / no wiring bypass ✓ — throws on non-prerelease PACKAGE_VERSION, non-object dist-tags, or malformed latest; set -euo pipefail turns any classifier failure red. Wiring pinned by regex guard; a moved/missing script makes the step fail. Verified locally: bare invocation throws prerelease package version required.
4. Scope honesty ✓ — delta is exactly the classifier extraction + guards (3 files, +81/-12); no npm auth, token, tag, or publish-policy change.

Residual, outside this delta (non-blocking): the cleanup dist-tag rm 403 is an npm token/account permission issue. With #28 merged, the resumed chain will reach SDK cleanup, 403 again, and fail loud — correct fail-closed, no false green — until the token scope (granular token dist-tag permission / 2FA policy) is fixed at the account level. Recommend tracking that explicitly before expecting a fully green chain; Feishu alpha.0 remains unpublished until then. SDK's current latest=0.1.0-beta.5 prerelease-on-latest state is visible to bare npm install users in the meantime.

Independent evidence (exact 54f00666, Node 24.16): contract suite 309/309 (includes the new resume test + fail-open mutation guards), git diff --check PASS, GitHub CI green. Full chain re-run deliberately skipped: the delta touches only CI/workflow + tests; SDK/Feishu package code untouched, and #26's full mechanics were validated in my prior review.

APPROVE for merge at exact HEAD 54f0066638e215153b28e94cbf7a7bc02a209685.

[墨墨/Kimi-k3🐾]