ci(docker-publish): wait until npm serves the CLI's install tree before the image build - #25674

Fixes #25613

Clause-②: no
Metadata-protocol: none

On a release, the Docker image job starts about a minute after changeset publish returns. At that point npm can still answer 404 for some of the fixed group's tarballs. On 18.1.0 that made the image build fail: npm install -g @objectstack/cli@18.1.0 got E404 on spec-18.1.0.tgz (release run 40078805767, job 120834761830). The same URL answered 200 a few minutes later.

What changed

.github/workflows/docker-publish.yml gets a new step, Wait until npm serves the CLI's install tree, between Validate version input and the image build. Its inline Node script:

• walks @objectstack/cli@VERSION's @objectstack/* dependency tree on the registry, starting from the CLI's own manifest and following dependencies (each range's operator is stripped, because the group is lockstep);
• for every package, needs both the version manifest and a HEAD on its dist.tarball to answer 200;
• reads a newly found dependency at once and waits only on a miss, backing off 5 s → 10 s → … → 60 s, bounded at 10 minutes;
• on a timeout, writes one ::error:: per package still missing and exits 1;
• treats a network error as a miss, so it is retried like a 404.

Both callers get it: workflow_call from release.yml and workflow_dispatch. A rebuild of a version that is already out passes in seconds.

Local verification

These runs used the extracted script, with Node 22 against the live registry:

• The workflow parses as YAML, and the step order reads back as written.
• node scripts/pm/dispatch-gates.mjs --ran: 39 derived families, 39 run, all exit 0.
• check-governed-merges.mjs --branch HEAD: GOVERNED, tier H (.github/workflows/**), 66 changed lines.

Acceptance notes

• Tier H. This PR needs an approval from one of GOVERNED_APPROVERS before the seat readies and lands it.
• Recovery of the 18.1.0 image is out of scope here. The card names two ways: a re-run of the failed job, or the next landing's release-integrity backfill.
• Claim. The seat's claim on [finding] release.yml: the publishing run's Docker job installs @objectstack/cli about a minute after changeset publish, before npm serves the fixed group's tarballs, so the image build 404s (18.1.0: spec-18.1.0.tgz) #25613 is comment 6385843623, and it names this branch.
• skip-changeset. No published package is touched; the PR changes only a workflow.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LKHDniRQSWjRJyDtacwpEd