.github/workflows/publish.yml runs on every push to main on a cluster
runner. When @hanzo/gui's version on disk is ahead of npm's latest it
installs, builds, checks, lints and typechecks, reads NPM_TOKEN from KMS
the way hanzoai/i18n does (masked), and publishes the train with
`release.ts --republish --ci`, the one script that rewrites workspace:*.
Any other push answers "not ahead" in seconds; a dispatch at the served
version finishes a train that stopped part way.
It replaces publish-gui-all.yml, which never ran, with the npm-token
action and publish-gui-surface.mjs, a second publisher that covered
only the @hanzogui/* closure.
typecheck.sh called `tsgo`, which is not installed, so every typecheck
died on "command not found". TypeScript 7 ships as `tsc`.
Claude-Session: https://claude.ai/code/session_01BLLMyBFSvAfCt7ZGqYuiEz