feat(release): build the release pipeline for the seven FFI packages

.changeset/protect-ffi-repository-url.md.deferred

@@ -0,0 +1,19 @@
+---
+'@cipherstash/protect-ffi': patch
+---
+
+Point the published metadata at `cipherstash/stack`, the repository these
+packages are now built and published from. The wrapper's `repository.url`,
+`bugs.url` and `homepage`, and each platform package's `repository.url`, all
+named `cipherstash/protectjs-ffi`; each platform package's
+`repository.directory` also named `platforms/<platform>`, which resolves from
+the root of the repository named above and so addressed nothing here.
+
+npm requires `repository.url` to match the publishing repository exactly for a
+trusted publish, and rejects a mismatch rather than warning about it. A stale
+`repository.directory` fails more quietly: the publish succeeds and the source
+link on the package page 404s.
+
+The one repository URL that reaches an end user at runtime moves too — the Rust
+core's `InvariantViolation` error asks the reader to file an issue, and the
+repository it pointed at is archived at the end of the publishing cutover.

.changeset/supply-chain-skill-ffi-release-path.md

@@ -0,0 +1,39 @@
+---
+'stash': patch
+---
+
+Document the native-binding publish path in the bundled
+`stash-supply-chain-security` skill, and correct what it claims about
+frozen-lockfile coverage.
+
+`@cipherstash/protect-ffi` and its six platform packages ship compiled binaries,
+which `changeset publish` cannot produce — it packs from the workspace, where
+`index.node` is a build output. The skill now describes the pipeline that does:
+a registry-state gate, a target-explicit build matrix in a reusable workflow,
+and a publish step that ships the six platform packages before the wrapper and
+tags all seven itself, because changesets tags only what it published. It also
+records two npm requirements that fail late and quietly — `repository.url` must
+match the publishing repository exactly (and `repository.directory` resolves
+from that repository's root), and trusted-publisher configurations created after
+2026-05-20 need an explicit "Allowed actions" selection.
+
+It also now states, per action, which input disables that action's built-in
+caching and what that input defaults to. Two of the three default to caching
+ON — `actions/setup-node`'s `package-manager-cache` and `jdx/mise-action`'s
+`cache` — so omitting the key is not "no caching", it is caching spelled
+invisibly, and the gate's generic rule only sees a *truthy* value rather than a
+missing one.
+
+The OIDC section said `permissions: id-token: write` is what mints the token and
+left it there. It now says where that grant belongs: on the publishing jobs, not
+at the workflow level. A trusted publisher is registered against a repository
+*and a workflow filename*, so npm accepts a token minted by any job in the
+registered file — declaring the scope at the top hands the publish credential to
+every job that does not override it, including ones added later.
+
+The frozen-lockfile section said the rule was enforced in `tests.yml`, which was
+true and misleading: that is where it was *checked*, and `release.yml` ran a
+bare `pnpm install` from the day it was written — so the single install permitted
+to resolve outside the lockfile was the one whose output goes to the registry.
+The install is fixed and the check now scans every workflow and every local
+composite action.

.github/actionlint.yaml

@@ -0,0 +1,12 @@
+# actionlint validates every `runs-on:` against the list of GitHub-hosted runner
+# labels it ships with. Blacksmith runners are self-hosted from its perspective,
+# so without this file each of the fourteen jobs using one is reported as an
+# unknown label — and the release lint gate (.github/workflows/lint-release.yml)
+# would be red on the day it lands, for reasons that have nothing to do with the
+# release machinery it exists to check.
+#
+# Nothing complained before because actionlint has never run in this repository;
+# lint-release.yml is what introduces it.
+self-hosted-runner:
+  labels:
+    - blacksmith-4vcpu-ubuntu-2404