ci: verify the tarball and release tag before publishing

[macieju-opera]

npm publish is irreversible — a version published from a broken tarball can only be abandoned. Nothing checked what it was about to push.

Why the existing check never helped

pre-release.yml never ran. It triggers on release-please-* branches; release-please was removed in d500b24. Only workflow_dispatch reached it. And being a separate workflow, it could not have blocked npm publish even if it had run.

verify-npm-package.js never worked. It read:

const files = data['chrome-devtools-mcp'].files.map(f => f.path);

Two bugs: that is the upstream package name, and npm publish --json is not keyed by package name at all — it is flat (name, files, entryCount, …). Every invocation threw and exited 1, caught by the try/catch as failed to parse npm publish output.

0.4.2 shipped a correct tarball by luck, not verification.

What this does

Moves the check into publish-to-npm-on-tag.yml, between npm run bundle and npm publish, where it can actually stop a bad release. The script now:

• reads npm pack --dry-run --json instead of npm publish --dry-run — no registry, no auth, and no failure once the version exists, so it cannot spuriously block a release
• derives required entry points from package.json bin rather than hardcoding, so a renamed binary cannot ship missing
• fails when RELEASE_TAG does not name the packed version

That last check is new and covers a real gap: nothing stopped someone tagging v0.4.3 while package.json said 0.4.2.

pre-release.yml is deleted, and listed in the rename-or-delete table so the guard added in #55 keeps it from reappearing on an intake.

Verified

Case	Result
clean tree	contains all 4 required entry point(s) of 339 packed — exit 0
RELEASE_TAG=…v0.4.2	tag … matches opera-devtools-mcp@0.4.2 — exit 0
RELEASE_TAG=…v0.4.3	tag … does not name the version being published — exit 1
build/src/index.js removed	tarball is missing 1 required file(s) — exit 1
pre-release.yml restored	seam check fails, as intended

Exit codes checked directly, not through a pipe — a check that prints an error but exits 0 would not fail CI.