KMS is where the fleet's secrets live, so the publish step reads NPM_TOKEN at
run time with the same machine identity every other workflow here uses — the
same path @hanzo/ui publishes from. Nothing new to rotate, and no npm
credential sits on the forge.
Also drops the package.json path filter. The skip step already asks the
registry whether it serves something older than this tree, which is the one
question that matters; a path gate in front of it guesses the same answer from
the shape of a diff and gets it wrong in both directions.
Two surfaces had already agreed on what a hero film is — full bleed, two
masters picked by orientation, an SSR-correct still, reduced motion gets the
ending, no loop — and the agreement lived in one app's components directory.
The second surface that wanted one would have copied it, and the two copies
would have drifted.
So the decisions move here and the surfaces state only what is theirs: a
prefix and a sentence. `<Frame src="/hero" alt="…" />` resolves the six
rendered files by name, which makes a per-page film a matter of assets rather
than of code.
Rendering stays in hanzoai/frames. This package only plays what that one cuts.
zooqueen