fix(openclaw): verify the published npm Registry artifact

[linfangw]

Summary

• add a post-publish npm Registry verification gate for the OpenClaw plugin
• require the exact published version, integrity metadata, and gitHead
• install the exact Registry version through openclaw plugins install ... --pin in fresh isolated state
• verify the managed lock integrity, loaded status, manifest/registration metadata, and concrete compiled-factory tool descriptors
• retry only transient Registry/install failures and fail closed on contract or provenance drift
• run publishing and verification as separate jobs, keeping GitHub Release creation after the Registry gate

Root cause

The publish workflow verified a locally packed tarball before npm publish, then created the GitHub Release without exercising the artifact consumers receive from the npm Registry. A local source or tarball check could therefore pass while Registry propagation, provenance, package contents, or the official OpenClaw installation path was broken.

Deep review also found three recovery/semantic gaps in the first implementation:

• a post-publish failure could not be safely retried because rerunning the same job attempted the immutable npm publish step again;
• OpenClaw inspection exposed registration declarations, not the concrete descriptors instantiated by the installed compiled factory.
• the first job split relied on GITHUB_ENV crossing jobs, which would have produced a GitHub Release with an empty version.

Safety and recovery

• each install attempt uses a new isolated OpenClaw state directory
• failed attempts are cleaned before retrying
• the public npm Registry is fixed explicitly for metadata and installation
• version, source commit, downloaded lock integrity, installed root, package identity, and runtime contract mismatches are non-retryable
• failed verification/Release jobs can be rerun without rerunning the successful publish job
• the verification job independently revalidates and loads the tag/package version
• publish receives only contents: read plus OIDC; only the Release job receives contents: write
• command diagnostics redact synthetic and configured credential values
• the smoke uses only a synthetic QVeris key and makes no paid QVeris calls

Validation

• 29 Registry-release fault-injection, tamper, cleanup, compiled-runtime, and workflow-order tests
• real npm Registry smoke against @qverisai/qveris@2026.7.30 with OpenClaw 2026.7.1-2
• OpenClaw plugin: 79 tests, typecheck, lint, coverage, and 19-file pack check
• full monorepo: CLI 134, MCP 181, JavaScript SDK 67, Python SDK 183 passed / 1 skipped, release tooling 42
• full monorepo typecheck, build, and lint
• current-head GitHub Actions matrix passed on Ubuntu and Windows: https://github.com/QVerisAI/qveris-agent-toolkit/actions/runs/30523104885
• public documentation boundary scan

Closes #282

[ax2]

@codex review