fix: release through cyberuni OIDC workflows, no repo secrets

[unional]

Phase A of the secretless-release sweep. Do not merge before the repo is transferred to cyberuni and all three packages have a trusted publisher registered — this PR is deliberately written against the world after the transfer.

What changes

• Both CI jobs point at cyberuni/.github. grep -rn "unional/.github" .github/workflows/ returns nothing.
  • code moves from unional's pnpm-verify-linux.yml to cyberuni's pnpm-verify.yml pinned to os: '["ubuntu-latest"]' — cyberuni has no -linux variant, and pinning ubuntu is the same effect. skip-playwright: true: all three vitest projects are environment: 'node' with no browser provider and no stories.
  • release moves to pnpm-release-changeset-oidc.yml with an explicit permissions: block (id-token: write, contents: write, pull-requests: write), replacing secrets: inherit.
• merge_group: added to pull-request.yml, so the repo can join a merge queue after the transfer.
• Publish gate wired in as a needs: of the release job, matching the post-2026-08-30 shape on the batch-2 repos — it runs on main immediately before changeset publish, not on the Version PR where it can never fire.
• repository / homepage / bugs and every README badge now name cyberuni/async-fp. The npm scope is unchanged: @unional/async-context and @unional/gizmo keep their @unional/ names, because trusted publishing pins the repo, not the scope.
• A deliberate patch changeset on all three packages, so the first post-transfer release actually moves a version and Phase C's registry proof can advance.

Incidental: packages/gizmo/README.md's codecov badge pointed at a master branch that does not exist; corrected to main.

This also fixes a live release outage

release.yml has failed on every push to main since 2026-08-14 — four consecutive runs. unional/.github's pnpm-release-changeset.yml was running changesets/action@v2 with the v1 input names:

Error: The following inputs have been renamed:
  - "publish" -> "publish-script"
  - "version" -> "version-script"
  - "commit"  -> "commit-message"

cyberuni's pnpm-release-changeset-oidc.yml pins changesets/action@v2.1.0 with the v2 names, which is also the pairing @changesets/cli@^3 needs.

Verified before touching anything

All three local version fields match dist-tags.latest read straight from registry.npmjs.org — async-fp 9.0.13, @unional/async-context 9.0.13, @unional/gizmo 2.3.1. No 0.0.0-development placeholder anywhere. .husky/commit-msg invokes pnpm, not yarn.

Not done here

No transfer, no npm trust, no merge, no auto-merge armed, no secret deleted, default_workflow_permissions left at write.

🤖 Generated with Claude Code

https://claude.ai/code/session_014RLRX3QtRpgCfDt16KShQC

[changeset-bot]

🦋 Changeset detected

Latest commit: 95937d2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@unional/async-context	Patch
@unional/gizmo	Patch
async-fp	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.93%. Comparing base (af7d8fe) to head (95937d2).
⚠️ Report is 86 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##              main     #363       +/-   ##
============================================
- Coverage   100.00%   60.93%   -39.07%     
============================================
  Files           10        6        -4     
  Lines          117      256      +139     
  Branches        22       21        -1     
============================================
+ Hits           117      156       +39     
- Misses           0      100      +100     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request