BREAKING CHANGE: Upon publishing, in order to apply a default "latest"
dist tag, the command now retrieves all prior versions of the package.
It will require that the version you're trying to publish is above the
latest semver version in the registry, not including pre-release tags.

Implements [npm
RFC7](https://github.com/npm/rfcs/blob/main/accepted/0007-publish-without-tag.md).

Related to prerelease dist-tag: #7910
A part of npm 11 roadmap: npm/statusboard#898

---------

Co-authored-by: Jordan Harband <ljharb@gmail.com>

npm/cli#7910

Signed-off-by: Andrew Haines <haines@cerbos.dev>

This became required with npm/cli#7910.

This became required with npm/cli#7910.

… Releases (#251)

* ci(release): publish prereleases to `next`; put the CHANGELOG in GitHub Releases

npm 11 refuses to publish a prerelease without an explicit --tag (npm/cli#7910),
and the workflow passed none, so a v0.14.0-rc.0 tag would have run the whole
release gate and then failed to publish. scripts/release-channel.mjs now picks
the dist-tag (`next` for a prerelease, `latest` otherwise, always explicit) and
extracts the version's CHANGELOG section; the GitHub Release leads with it,
followed by the generated pull-request list, and a prerelease is marked as one.

CONTRIBUTING.md described a direct publish and a direct push to main; it now
documents the staged publish, the protected-branch release PR, and prereleases.

* ci: re-trigger checks after updating with main

N1: pre-release counters start at 1 (SEMVER refuses -alpha.0), tested.
N2: the contract names the one release version its gates are written for
("version": "3.0.0"); the resolver asserts it against the tag's base version,
so v3.1.0-alpha.1 cannot pass 3.0.0's gates; lint rule C5 with two seeds
(thirteen contract seeds now), tests.
S2: runbook L8 expects fuzz_regressions 6 on the tagged tree (PR 48's seeded
control). S3: L4 and the time table say the rows sum to 37 to 47 minutes and
the first G6 figure will likely exceed 1,800 s, recorded, nothing fails.
S4: the verify row says a timeout is rerun-safe, nothing was published.
N3: the unpublish clause states npm's conditions for an existing package.
N4: the npm CLI changelog (11.0.0-pre.0, npm/cli#7910) is cited for --tag next.
P2 no longer says "on the lead's instruction": FORMA-185 is on main (PR 48).
The evidence sets are removed here and regenerated at this tree in the next
commit (S5), with one live-mode set beside the dry runs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>