chore: drop NPM_RELEASE_READY gate from tag publish

.github/workflows/README.md

@@ -109,27 +109,21 @@ exact GitHub Actions coordinates:
 - Allowed action: `npm publish`
 
 Trusted Publisher configuration is available only after the npm package exists.
-Complete these one-time steps before allowing a version-tag release:
-
-1. Authenticated as an npm maintainer, bootstrap the scoped package with a
-   throwaway non-release version such as `0.0.0` and the `bootstrap` dist-tag.
-   Use a temporary checkout so changing package metadata cannot dirty a working
-   branch. From `js/`, run `npm ci`, `npm run quality`,
-   `npm version 0.0.0 --no-git-tag-version`, and then
-   `npm publish --access public --tag bootstrap`.
-2. Configure the npm Trusted Publisher using the exact coordinates above.
-3. Create the GitHub `npm` deployment environment, restrict its deployment tags
-   to `v*`, and add required reviewers. This keeps a write-capable actor from
-   publishing solely by pushing a matching tag.
-4. Set the repository Actions variable `NPM_RELEASE_READY=true`.
-
-The shared release preflight checks both that variable and public package
-existence before any npm or crates.io write starts. Until setup is complete a
-tag fails safely before publishing a partial release; the workflow can be rerun
-after setup. Tagged npm releases then authenticate through GitHub Actions OIDC.
-The workflow intentionally has job-scoped `id-token: write`, uses npm 11.5.1 or
-newer, and does **not** require or accept a long-lived `NPM_TOKEN` repository
-secret.
+One-time bootstrap (already completed for this repo):
+
+1. Publish a throwaway non-release version such as `0.0.0` for
+   `@hops-ops/distributed` on the public npm registry.
+2. Configure the npm Trusted Publisher using the exact coordinates above
+   (`npm trust github @hops-ops/distributed --file on-v-tag-publish.yaml
+   --repo hops-ops/distributed --env npm --allow-publish`).
+3. Create the GitHub `npm` deployment environment (optional protection rules:
+   tag pattern `v*`, required reviewers).
+
+Release preflight validates the tag form and that `@hops-ops/distributed`
+exists on the public registry before any npm or crates.io write starts. Tagged
+npm releases authenticate through GitHub Actions OIDC. The workflow
+intentionally has job-scoped `id-token: write`, uses npm 11.5.1 or newer, and
+does **not** require or accept a long-lived `NPM_TOKEN` repository secret.
 
 ## Why this monorepo doesn’t call `quality.yaml`
 

.github/workflows/on-v-tag-publish.yaml

@@ -9,9 +9,7 @@ permissions:
   contents: read
 
 jobs:
-  # Keep every registry write behind an explicit one-time npm bootstrap gate.
-  # This prevents the Rust crates from publishing when the new npm package or
-  # its trusted-publisher configuration is not ready yet.
+  # Fail closed before crates publish if the public npm package is missing.
   release-preflight:
     name: Verify release registries are ready
     runs-on: ubuntu-latest
@@ -25,18 +23,9 @@ jobs:
             exit 1
           fi
 
-      - name: Require completed npm bootstrap
-        env:
-          NPM_RELEASE_READY: ${{ vars.NPM_RELEASE_READY }}
-        run: |
-          if [[ "$NPM_RELEASE_READY" != "true" ]]; then
-            echo "Set the repository Actions variable NPM_RELEASE_READY=true only after the npm bootstrap and trusted-publisher setup are complete." >&2
-            exit 1
-          fi
-
       - name: Verify npm package exists
         run: |
-          package_name="$(npm view @hops-ops/distributed@0.0.0 name)"
+          package_name="$(npm view @hops-ops/distributed name)"
           if [[ "$package_name" != "@hops-ops/distributed" ]]; then
             echo "Expected @hops-ops/distributed on npm, got: $package_name" >&2
             exit 1