ci: fix Release pipeline so merges publish to npm; idempotent GH Packages

[WomB0ComB0]

Problem

The Release workflow has failed on every push to master, and npm has been frozen at 0.4.0 since March 17. Two independent bugs:

1. npm never publishes on PR merges

The job used JoshuaKGoldberg/release-it-action, which gates on should-semantic-release. That tool returns false for "Merge pull request #N" HEAD commits — and this repo merges PRs with merge commits:

Checking commit: Merge pull request #2 … Found a release commit. Returning false.

So release-it never ran → nothing reached npmjs.

2. The job crashed every run on GitHub Packages

npm error You cannot publish over the previously published versions: 0.4.1.

The "Publish to GitHub Packages" step always re-published the current version. 0.4.1 was cut to GitHub Packages once (but never to npmjs), so the step has hard-failed ever since.

Fix

• Call release-it directly (bunx release-it --ci) instead of release-it-action. Its conventional-changelog plugin reads the full commit range since the last tag and computes the bump regardless of merge strategy, so normal PR merges now release.
• Job-level if skips the run triggered by release-it's own chore: release vX commit — replacing the re-trigger guard the action used to provide (no release loop).
• Idempotent GitHub Packages step — skips if the version already exists instead of failing the job.
• workflow_dispatch added for manual releases.
• .release-it.json: requireCommitsFail: false → no-op pushes skip cleanly.
• cspell.json: allow inlines / pyproject → fixes the red Lint Spelling check.

Before merging — two prerequisites

1. NPM_TOKEN secret must be a valid npm automation token. This is what the pipeline publishes with; it has been untested since the gate blocked release-it entirely. If it is stale, the npm publish will fail.
2. A 0.4.1 git tag needs to exist on the repo (it does not today — only 0.2.0/0.3.0/0.4.0). The commit 0aa90ce is literally chore: release v0.4.1, so tagging it reconciles history and makes the next release compute to 0.4.2 (not a duplicate 0.4.1). (Being pushed alongside this PR.)

On merge

release-it computes a patch bump from the fix: commits since 0.4.1 → cuts 0.4.2: updates CHANGELOG.md, tags 0.4.2, creates the GitHub release, and publishes to both npmjs and GitHub Packages. That ships the security fixes (PR #1) + the vitest bump (PR #2) to the public registry.

Validation (local)

• bun run lint:spelling → 0 issues
• .release-it.json + cspell.json valid JSON; release.yml valid YAML (triggers push+workflow_dispatch, if guard parses, 8 steps)
• release-it --dry-run reaches the publish step (only stops on local npm auth, as expected)

[github-actions]

👋 Hi @WomB0ComB0, thanks for the pull request! A scan flagged some concerns with it. Could you please take a look?

[pr-linked-issue] This pull request is not linked as closing any issues. This repository keeps to GitHub issues for discussing potential changes. Most or all changes should be marked as approved in an issue before a pull request is sent to resolve them. To resolve this report:

• If this is a straightforward documentation change that doesn't need an issue, you can ignore this report
• If there is a backing issue, add a 'fixes #...' link to the pull request body
• Otherwise, file an issue explaining what you'd like to happen

[pr-task-completion] This PR's body is missing [x] checks on the following tasks from the PR template.

• Addresses an existing open issue: fixes #000
• That issue was marked as status: accepting prs
• Steps in CONTRIBUTING.md were taken

Repositories often provide a set of tasks that pull request authors are expected to complete. Those tasks should be marked as completed with a [x] in the pull request description. Please complete those tasks and mark the checks as [x] completed.

🗺️ This message was posted automatically by OctoGuide: a bot for GitHub repository best practices.