feat(release): prepare ASF npm candidates

[M4n5ter]

English

Summary

• add a credential-free workflow that prepares one unsigned npm convenience candidate from the exact annotated ASF source RC tag;
• reuse the immutable CLI package validation matrix and carry the same tarball through Linux, macOS, Windows, and Eval checks;
• add SHA-512 and a closed, independently verifiable record binding the tarball bytes to the source tag, commit, repository, workflow, run, and attempt;
• document the Release Manager handoff and the boundary around signing, voting, credentials, and publication.

Scope and dependency

This is the first, non-publishing slice of G8. It depends on #3222 for the unified product identity, npm package construction, and reusable validation workflow.

The workflow deliberately does not sign artifacts, call npm staging or publication, modify dist-tags, or claim that the source release has passed either required vote. Those requirements remain tracked in #3275.

Refs #3275.

Verification

• node --test scripts/asf-npm-candidate.test.mjs scripts/asf-npm-workflow-policy.test.mjs
• mise exec go -- go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/asf-npm-candidate.yml .github/workflows/cli-package-validation.yml
• npm run build
• npm run format:check
• npm run lint
• npm run check:release
• real npm tarball creation and npm run release:cli:smoke

简体中文

概述

• 新增一个无凭据工作流，从精确的 ASF 源码 RC annotated tag 准备唯一的未签名 npm convenience candidate；
• 复用不可变 CLI 包验证矩阵，让同一份 tarball 通过 Linux、macOS、Windows 和 Eval 检查；
• 增加 SHA-512 以及闭合、可独立验证的记录，将 tarball 字节绑定到源码 tag、commit、仓库、工作流、run 和 attempt；
• 记录 Release Manager 交接流程，并明确签名、投票、凭据和发布的职责边界。

范围与依赖

这是 G8 的第一个非发布阶段。它依赖 #3222 提供统一产品身份、npm 包构建和可复用验证工作流。

该工作流刻意不签名、不调用 npm staging 或发布、不修改 dist-tag，也不声称源码 release 已通过任一必要投票。其余要求继续由 #3275 跟踪。

Refs #3275。

验证

• node --test scripts/asf-npm-candidate.test.mjs scripts/asf-npm-workflow-policy.test.mjs
• mise exec go -- go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/asf-npm-candidate.yml .github/workflows/cli-package-validation.yml
• npm run build
• npm run format:check
• npm run lint
• npm run check:release
• 实际 npm tarball 构建及 npm run release:cli:smoke