fix(release): close the review findings on the release sequences

The root manifest carries the dsh family version. bump writes it with the
members, because the workspace constraint requires them to match, and that
constraint now accepts a prerelease segment: without both, release:dsh 0.0.2
left the root behind and 0.0.1-rc.1 could satisfy neither check.

The Landlock workflow no longer passes --access public, which overrode the
restricted publishConfig this repository just adopted for those packages.

Vendored change detection reads build inputs when a package publishes build
output, and vendor/cordis publishes the src its export map already pointed at:
its lib/ is untracked, so a real source edit read as 'nothing changed' and the
next publish would fail on a version whose bytes moved. The next version also
takes the last published version as its baseline, so a re-sync that restores a
lower upstream version cannot recompute a version already on the registry, and
bump confirms the registry carries what the newest tag names.

Tag prefixes are constructed rather than recovered from a full tag, which a
hyphenated version defeated. Pack runs group per ref so concurrent pull requests
stop displacing each other, the publish job carries the global group, and the
unused id-token permission is gone.

Every release script sits behind an entry guard, which is what lets the pure
judgements carry tests: tag naming, publish order and cycle reporting, version
arithmetic, payload policy, and the change judgement.

The Agent Note moves to implemented and states what shipped: one probe command,
the registry confirmation that now exists, and byte reproducibility recorded as
assumed rather than measured.

.github/workflows/landlock-run-release.yml

@@ -172,5 +172,7 @@ jobs:
           tag_args=()
           case "$version" in *-*) tag_args=(--tag next);; esac
           while IFS= read -r tarball; do
-            npm publish "dist/npm/${tarball}" --access public "${tag_args[@]}"
+            # No --access: publishConfig.access in each manifest decides, and a
+            # command-line flag would override it.
+            npm publish "dist/npm/${tarball}" "${tag_args[@]}"
           done < dist/npm/publish-order.txt

.github/workflows/release-vendor.yml

@@ -23,7 +23,9 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}
+  # Pack runs per ref so concurrent pull requests never displace each
+  # other; the publish job below serializes the shared dist-tag state.
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 
 env:
@@ -96,9 +98,11 @@ jobs:
     needs: pack
     runs-on: ubuntu-24.04
     environment: npm-publish
+    concurrency:
+      group: Release-publish
+      cancel-in-progress: false
     permissions:
       contents: read
-      id-token: write
     steps:
       # Checkout and install carry the release scripts only; no build step.
       - uses: actions/checkout@v6

.github/workflows/release.yml

@@ -23,8 +23,9 @@ permissions:
   contents: read
 
 concurrency:
-  # dist-tags are shared registry state; never race two release runs.
-  group: ${{ github.workflow }}
+  # Pack runs per ref so concurrent pull requests never displace each
+  # other; the publish job below serializes the shared dist-tag state.
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 
 env:
@@ -103,9 +104,11 @@ jobs:
     # Required reviewers and the allowed tags live on the environment; this is
     # the only step in the sequence that can write to the registry.
     environment: npm-publish
+    concurrency:
+      group: Release-publish
+      cancel-in-progress: false
     permissions:
       contents: read
-      id-token: write
     steps:
       # Checkout and install carry the release scripts only. There is no build
       # step: publication uploads the bytes the pack job produced.