chore: the home registry is The Source, never 'the forge' — sweep the misnomer out of the release rail, workflows, and release notes (Forge is a different product; the stored CI secret keeps its historical name)

.forgejo/workflows/publish-source.yml

@@ -0,0 +1,70 @@
+name: Publish (The Source)
+
+# Datacenter-side publish to The Source (source.soulcraft.com — our
+# self-hosted Forgejo; never call it "the forge", Forge is a different
+# product), moved off the laptop: an 87MB tarball PUT over the laptop's WAN
+# times out; The Source's own runner does it in seconds.
+# scripts/release.sh tags + pushes, then polls this workflow's result (npm
+# view against The Source's registry) before it ever touches the npmjs leg —
+# see the "delegation contract" in scripts/release.sh's home-publish step.
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    name: Publish to The Source registry
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - name: Publish + readback-verify on The Source registry
+        env:
+          # The stored repo-settings secret keeps its historical name.
+          FORGE_NPM_TOKEN: ${{ secrets.FORGE_NPM_TOKEN }}
+        run: |
+          set -eo pipefail
+
+          SOURCE_NPM_REG="https://source.soulcraft.com/api/packages/soulcraft/npm/"
+          VERSION="$(node -p "require('./package.json').version")"
+          echo "Publishing @soulcraft/brainy@${VERSION} to The Source registry..."
+
+          TMPRC="$(mktemp)"
+          chmod 600 "$TMPRC"
+          {
+            echo "@soulcraft:registry=${SOURCE_NPM_REG}"
+            echo "//source.soulcraft.com/api/packages/soulcraft/npm/:_authToken=${FORGE_NPM_TOKEN}"
+          } > "$TMPRC"
+
+          # The release script bumps package.json's version before it tags, so
+          # this tag's checkout already carries the version being published —
+          # nothing here re-derives it from the tag name.
+          PUBLISH_OK=true
+          if ! npm publish --tag latest --userconfig "$TMPRC"; then
+            PUBLISH_OK=false
+          fi
+
+          # Readback verify is the source of truth, run regardless of the publish
+          # exit code: a benign duplicate publish (a prior run, or a mirror, already
+          # landed this exact version) reports failure even though the registry
+          # already holds the right content.
+          LANDED_VERSION="$(npm view "@soulcraft/brainy@${VERSION}" version --userconfig "$TMPRC" 2>/dev/null || echo "")"
+          rm -f "$TMPRC"
+
+          if [ "$LANDED_VERSION" != "$VERSION" ]; then
+            echo "::error::Readback verify FAILED — The Source registry reports version '${LANDED_VERSION:-<none>}', expected '${VERSION}'. This is a genuine publish failure, not a benign duplicate."
+            exit 1
+          fi
+
+          if [ "$PUBLISH_OK" = true ]; then
+            echo "Published and verified @soulcraft/brainy@${VERSION} on The Source registry."
+          else
+            echo "::warning::npm publish reported failure, but readback confirms @soulcraft/brainy@${VERSION} is already live on The Source (a prior run or mirror landed it) — treating this run as successful, since the registry content is correct. Any OTHER failure mode would have failed the readback check above instead."
+          fi