The verifier packed with pnpm while the publish job packed with bun, so the
tarball that was inspected was not the tarball that shipped -- and the runner
carries no pnpm, which is where the publish run stopped.
The two packers do not agree. pnpm applies the publishConfig entrypoints; bun
does not, and eleven packages name their built files there. Packed by bun
alone they would publish an `exports` map pointing at TypeScript sources that
`files` does not carry.
scripts/pack.mjs is now the one packer: bun rewrites the workspace specifiers
to the concrete version, the publishConfig entrypoints are applied on top, and
the manifest on disk is put back byte for byte. The verifier and the publish
job both call it, so what is verified is what is uploaded.
zooqueen
1c56d091d6