chore(ci): watch the distribution that exists, not the npm sync that never will

[askalf]

Follow-up to the README sweep (#117), which flagged these two workflows as carrying a premise that is no longer true.

npm-drift.yml → distribution-check.yml

The drift watch compared npm's published version against the latest GitHub release and opened an issue when they diverged. That comparison is now permanently false by design: npm's content scan rejects redstamp's real tarball, the allowlist review was declined, and @askalf/redstamp is a deliberate deprecated pointer stub that will never match the release.

A watch that can only ever fail is noise. It has kept issue #55 open since 2026-07-11 with "to fix" steps that cannot work — dispatch the publisher (it will 403), or re-bind the trusted publisher (it is bound fine).

Replaced with a check of what actually has to hold for the real distribution to work:

1. The latest release still ships redstamp.tgz AND redstamp.tgz.sigstore.json. This is the documented install; a release missing either breaks gh release download or gh attestation verify silently.
2. npm's @askalf/redstamp is still a 0.0.x pointer. If a real version ever appears there, either npm reversed the decision (act on it) or something published by mistake (act faster).
3. That pointer is still deprecated, and its notice still points home. If the deprecation were ever cleared, npm i @askalf/redstamp would install a package that throws on import with no warning at all — a genuinely bad user experience that nothing else would catch.

Kept from the old workflow: the daily 04:17 UTC schedule, dispatch trigger, no-checkout remote-only reads, and the refresh-in-place issue handling (one issue, always current, auto-closes when healthy) — that part was recently fixed in #114 and is worth keeping.

publish.yml — comments only, no behaviour change

The header and the gate notice said redstamp was "awaiting an npm content-scan allowlist". It is not awaiting anything; the review was declined on 2026-08-01. Updated to say the gate is permanent by design, that npm holds a pointer stub, that the signed release tarball is the distribution, and — importantly for a future session — not to flip NPM_PUBLISH_ENABLED to retry on a hunch, because the block is deterministic and a retry just re-fails. That has already cost two wasted publish attempts.

Verified

• Both workflows parse as valid YAML.
• No behaviour change to publish.yml — comments and one ::notice:: string only; the gate logic is untouched.

Follow-up for a human

Issue #55 should be closed manually with a pointer to this change. The new check uses a different marker, so it will not adopt or auto-close the old issue.

[sprayberry-reviewer]

Automated review from the Sprayberry Labs fleet code reviewer.

Verdict: No blocking issues found — approving. One minor robustness note below.

What I checked

• gh pr diff 118 (full diff: new distribution-check.yml, deleted npm-drift.yml, comment-only edits to publish.yml).
• CI check-rollup via gh pr checks 118: CodeQL, analyze, and all 4 test matrix jobs (ubuntu/windows × node 20/22) — all pass.
• publish.yml's diff is confirmed comment/::notice::-string only; the gate logic (if [ "${NPM_PUBLISH_ENABLED:-}" != "true" ]) is unchanged.

Minor (non-blocking)

.github/workflows/distribution-check.yml:64

npm_dep=$(npm view @askalf/redstamp deprecated 2>/dev/null || true)

This swallows any failure of npm view (e.g. a transient registry error), not just the "package not deprecated" case (which legitimately prints nothing). A transient error and a real "not deprecated" state both leave $npm_dep empty, so a flaky npm view call would falsely report "The npm pointer stub is NOT deprecated" and refresh the alert issue with an incorrect problem. Not blocking — worst case is a spurious/noisy issue refresh that self-corrects on the next daily run, and npm_v (the sibling call two lines up) has no such guard so a real network failure there still fails the job loudly via set -e.

# distinguish "not deprecated" (empty stdout, exit 0) from a real npm-view failure
npm_dep=$(npm view @askalf/redstamp deprecated 2>/dev/null)

What's good

• The asset-presence checks (case " $assets " in *" redstamp.tgz "*)) correctly space-pad to avoid redstamp.tgz false-matching as a substring of redstamp.tgz.sigstore.json.
• Comments clearly document why (declined allowlist review, deterministic gate) rather than restating the code, and explicitly warn against flipping NPM_PUBLISH_ENABLED on a hunch — good context for a future session.
• publish.yml changes verified as comment/notice-only, matching the PR description's "no behaviour change" claim.
• Old workflow's "refresh in place, don't freeze" issue-handling behavior is preserved via the same marker-based dedup pattern.