[jefft72]

Summary

Adds a safe, resumable first-publication workflow for the currently unregistered Diffex npm packages and clears the stale tests that blocked the official release suite.

Reasoning

npm requires a package to exist before trusted publishing can be configured, while the normal Diffex release correctly refuses unregistered packages.
The bootstrap must avoid claiming CI provenance or assigning the default latest tag, remain safe after partial publication, and preserve the existing normal-release guard.

Changes

• Adds bootstrap and dry-run commands that validate every archive and publish initial versions under the non-default bootstrap tag
• Rejects bootstrap use for established packages while allowing exact-version resumes after partial publication
• Emits the trusted-publisher commands for the existing GitHub workflow and documents the complete first-release process
• Adds repository metadata required for trusted publishing to the coding-agent server package
• Removes a stale Fireworks router assertion and aligns compaction tests with the current call contract
• Adds unit coverage for bootstrap argument parsing, package-state safety, publish command construction, and trust setup

Testing

• npm run release:bootstrap-npm:dry
• npm run build:offline
• HOME=/private/tmp/diffex-release-readiness-home ./test.sh