chore: add 2.0.4 release verification gate (#42)

Co-authored-by: Foscat <fosterkyle6356@gmail.com>

Author: Foscat

docs/PUBLISHING.md

@@ -3,10 +3,11 @@
 ## Dry run
 
 ```bash
-npm run check
-npm run pack:dry-run
+npm run release:verify
 ```
 
+`npm run release:verify` is the non-publishing hotfix release gate. It runs `npm run check`, `npm run test:e2e`, `npm run test:visual`, `npm audit --audit-level=moderate`, and `npm run pack:dry-run`.
+
 `npm run check` rebuilds dist CSS, runs stylelint, executes package, class API, shared theme-color, and vendor-prefix unit checks, validates core text/link contrast pairs and filled component `on-*` contrast pairs, and confirms package metadata. `npm run pack:dry-run` shows the exact files that would publish.
 
 `npm run build` uses the exactly pinned Lightning CSS parser-minifier. Generated minified bundles retain the release banner while preserving grammar-sensitive selector and `calc()` whitespace.
@@ -15,11 +16,13 @@ The npm artifact is library-focused: `dist/`, `styles/`, docs, and metadata. Dem
 
 ## Publish
 
+No package, tag, or registry release occurs without explicit approval.
+
 ```bash
 npm publish
 ```
 
-For GitHub releases, create or dispatch a release for the matching package tag, such as `v2.0.4`. The release workflows verify that `package.json`, `package-lock.json`, `CHANGELOG.md`, and generated dist banners are aligned before publishing.
+`prepublishOnly` runs `npm run release:verify`, so a direct `npm publish` still has the full hotfix release gate. For GitHub releases, create or dispatch a release for the matching package tag, such as `v2.0.4`. The release workflows verify that `package.json`, `package-lock.json`, `CHANGELOG.md`, and generated dist banners are aligned before publishing.
 
 ## Versioning
 

package.json

@@ -154,7 +154,8 @@
     "check": "npm run build && npm run lint && npm run test:unit && npm run check:contrast && npm run check:package",
     "pack:dry-run": "npm pack --dry-run",
     "prepack": "npm run check",
-    "prepublishOnly": "npm run check",
+    "release:verify": "npm run check && npm run test:e2e && npm run test:visual && npm audit --audit-level=moderate && npm run pack:dry-run",
+    "prepublishOnly": "npm run release:verify",
     "release:patch": "npm version patch && npm publish",
     "release:minor": "npm version minor && npm publish",
     "release:major": "npm version major && npm publish",

tests/package-integrity.test.js

@@ -296,7 +296,8 @@ test('release automation scripts are exposed', () => {
     'check:contrast',
     'check:package',
     'check',
-    'pack:dry-run'
+    'pack:dry-run',
+    'release:verify'
   ];
 
   for (const scriptName of requiredScripts) {
@@ -305,6 +306,26 @@ test('release automation scripts are exposed', () => {
   }
 });
 
+test('release verification script is non-publishing and covers the 2.0.4 release gate', () => {
+  const releaseVerify = packageJson.scripts['release:verify'] ?? '';
+  const requiredCommands = [
+    'npm run check',
+    'npm run test:e2e',
+    'npm run test:visual',
+    'npm audit --audit-level=moderate',
+    'npm run pack:dry-run'
+  ];
+
+  for (const command of requiredCommands) {
+    assert.match(releaseVerify, new RegExp(escapeRegExp(command)), `release:verify should run ${command}`);
+  }
+
+  // Keep the hotfix verification gate safe for approval-gated release preparation.
+  assert.doesNotMatch(releaseVerify, /\bnpm\s+(?:publish|version)\b/);
+  assert.doesNotMatch(releaseVerify, /\bgit\s+tag\b/);
+  assert.equal(packageJson.scripts.prepublishOnly, 'npm run release:verify');
+});
+
 test('package metadata is aligned for the release version', () => {
   assert.equal(packageLock.version, packageJson.version);
   assert.equal(packageLock.packages[''].version, packageJson.version);