fix(release): wait for npm registry visibility

[mldangelo-oai]

Summary

npm can accept a publication before its registry exposes the new version. An immediate GitHub release lookup then fails with E404. Wait for the requested version to become available before downloading and verifying the release archive.

Changes

• Retry missing-version responses every 30 seconds, with at most 21 registry lookups over ten minutes.
• Fail immediately for other registry errors and preserve their diagnostics.
• Document the wait and test immediate availability, delayed availability, persistent absence, and authorization failure with executable workflow tests.
• Merge current main while preserving the release wait and its regression coverage.

Testing

• Focused release automation suite: 296 passed, zero failures.
• After the main update to Codex CLI and SDK 0.162.0-alpha.14, full SDK orders passed with seed 12345 and random seed 117021954: each had 3,574 passes, 53 skips, and zero failures across 160 files.
• Those full orders preceded the subsequent main merges for C++ raw strings and UTF-8 export diagnostics. The C++ regression suites passed all 212 tests. After the final main merge, all six artifact export tests passed, including split UTF-8 diagnostics at successful and failed process exits. The final upstream merge changed four files; its only shipping runtime change was the artifact export helper, and shipping dependency locks were unchanged.
• At the final head: plugin generation, SDK build:ci, types, formatting, Ruff checks and formatting, plugin source compatibility, its checker tests, and git diff --check passed.
• Three fresh native reviews and fresh independent verification passed against the final main base, with no confirmed issues.

Risk and rollout

The release wait changes GitHub release automation. A version that remains absent after ten minutes still fails and can use the documented retry flow. Archive integrity, release identity, and signed provenance verification remain enforced. No public CLI surface changes.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T15:34:05.317247Z	515a4da	New commits
🔒 Security Review	✅ Completed 2026-10-05T15:34:23.026578Z	515a4da	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Reviewed the full contribution at 515a4daa1065d57bbdb14ab0e1412578076176df with selected base 1345ea3fa48021ef54ecc2dcc948fde43fec8d0c, including changed tests and touched context, using three independent reviews followed by root synthesis.

No supported introduced finding.

Static source review; tests were inspected but not executed. CI, mergeability and integration are separate.