chore(ci): rename release workflow to rc-tag-release and document publish gate

- Replace release.yml with rc-tag-release.yml; keep validate:publish before changeset publish
- Document maintainer flow (local validate, PR/CI, automated publish, post-publish smoke test)
- Add SPDX Apache-2.0 header to guardEvidence.ts for check-boundary

Author: betterdataco

.github/workflows/release.yml .github/workflows/rc-tag-release.yml.github/workflows/release.yml renamed to .github/workflows/rc-tag-release.yml

@@ -1,4 +1,10 @@
-name: Release
+# Maintainer publish flow:
+# 1) Local gate: pnpm build && pnpm validate:publish (packed manifests must not contain workspace:*)
+# 2) Land P0 packaging changes via PR; CI runs the same validate:publish step.
+# 3) Merge the changesets "Version Packages" PR (chore(release)) — this workflow runs validate:publish
+#    again before changeset publish; npm is not touched if validation fails.
+# 4) After publish: smoke test from a clean directory, e.g. npm install @loop-engine/sdk@<version>
+name: RC tag release
 
 on:
   push:

CONTRIBUTING.md

@@ -34,12 +34,20 @@ Run these commands from repository root before opening a PR:
 
 ```bash
 pnpm build
+pnpm validate:publish   # packed @loop-engine/* tarballs must not contain workspace:* (same gate as release)
 pnpm lint
 pnpm test
 pnpm validate-loops
 pnpm check-boundary
 ```
 
+## Publishing (maintainers)
+
+1. **Local gate** — `pnpm build && pnpm validate:publish`. This is the tarball check (not `npm publish`). It fails if any packed public package still has `workspace:` in its manifest.
+2. **Ship changes via PR** — packaging fixes (e.g. `package.json`, `.npmrc`, `scripts/check-no-workspace-refs.mjs`, workflow updates) go through CI like any other change.
+3. **Automated npm publish** — [.github/workflows/rc-tag-release.yml](.github/workflows/rc-tag-release.yml) runs on pushes to `main` whose head commit message contains `chore(release)` (the changesets “Version Packages” merge). It runs `validate:publish` again before `pnpm release` / `changeset publish`; if validation fails, nothing is published.
+4. **Post-publish smoke test** — from an empty directory, install the new version, e.g. `npm install @loop-engine/sdk@<version>`, and confirm the install is clean before announcing.
+
 ## Pull request conventions
 
 - Keep PR scope focused to one feature/fix area

packages/sdk/src/lib/guardEvidence.ts

@@ -1,3 +1,6 @@
+// @license Apache-2.0
+// SPDX-License-Identifier: Apache-2.0
+
 /**
  * guardEvidence
  *