ci: harden npm release workflow

[altaywtf]

Summary

Harden the npm release workflow around the live release GitHub Environment and environment-scoped NPM_TOKEN.

Changed

• Pins checkout/setup/release actions and adds Dependabot refreshes.
• Runs npm publish through the release Environment.
• Disables release dependency caching.

Risks

npm publishing depends on the already-configured NPM_TOKEN environment secret.

Verification

• actionlint .github/workflows/*.yml
• git diff --check
• pnpm verify
• codex-security:security-scan diff scan: no reportable findings

Complexity

Reduced.

[Copilot]

Pull request overview

This PR hardens the npm publish/release pipeline by scoping publishing credentials to the live release GitHub Environment, pinning high-trust GitHub Actions to commit SHAs, and documenting the release boundary.

Changes:

• Pin GitHub Actions (checkout, setup-vp, semantic-release-action) to full commit SHAs and add Dependabot updates for GitHub Actions.
• Move npm publishing to run under the release GitHub Environment, disable dependency caching for the release job, and add non-cancellable release concurrency.
• Add repo-local documentation describing the distribution/release flow and hardening guidelines.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
docs/DISTRIBUTION.md	Documents the release flow and hardening expectations for npm publishing.
AGENTS.md	Links contributors to the distribution/release documentation.
.github/workflows/ci.yml	Pins actions, scopes publishing to the release environment, disables cache for release, and tightens concurrency/permissions.
.github/dependabot.yml	Enables weekly Dependabot refreshes for pinned GitHub Actions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.