Add guarded publish recovery

[roodboi]

What changed

• add a manual recovery trigger to the trusted-publishing workflow
• allow that trigger only from the canonical repository's main branch
• retain the existing exact release-PR checks and PUBLISH environment gate
• test both authorized release paths

Why

The first standalone 4.1.0 publish failed before trusted publishing was enabled. GitHub reruns use the original workflow revision, so a guarded manual trigger is needed to retry with the corrected OIDC workflow without manufacturing another release PR.

Validation

• bun run format
• bun run lint
• bun test tests/workflow-security.test.ts
• bun run type-check
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f4766bb154

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin the recovery publish to the failed release

When the failed publish is recovered after main has advanced, this manual path still accepts the latest main checkout and the later bun run release step will publish that current tarball under the still-unpublished package version. That can ship unreleased commits as the recovery version instead of the exact release PR contents; consider requiring and checking out a specific release SHA/version for workflow_dispatch rather than accepting branch head.

Useful? React with 👍 / 👎.