Make a version bump the release

[pathscale]

Landing a fix on master publishes nothing today. Both release workflows fire on a tag only, so every release waits on someone remembering to push <package>-v<version> by hand, and master can sit ahead of npm indefinitely.

It currently is:

Package	master	npm
solid-layouts	0.2.1	0.2.1
rsbuild-plugin-solid-layouts	0.2.1	0.2.1
solid-layouts-oxc	0.2.3	0.2.2

The rule

A version bump is the release. This repository already bumps the version in the same commit as the fix, so the bump is the intent to release and nothing else needs saying. Both workflows now also run on a push to master, and each publishes a package when the version there is not on npm.

npm is the check rather than the diff. That makes it idempotent: a rerun, or a publish that died after packing, is safe to repeat. A merge that touched no version resolves to nothing and skips its build, rather than burning three matrix jobs to produce an artifact nobody publishes.

Nothing else changes. Tags still work for an explicit or repeat release and still fail when they disagree with package.json. Dispatch still builds a bootstrap artifact without publishing. The audited publish path, a GitHub-hosted job with id-token: write and no npm secret, is untouched.

@pathscale/test-ui is excluded from the automatic path: it is private: true and unpublished, so it ships only when a tag or a dispatch names it.

Not modelled on the UI release

@pathscale/ui infers the next version from commit messages via scripts/next-version.ts and writes a chore(release): … [skip ci] commit back to master. That makes the published version an output of parsing rather than a decision, and the parser is one more thing that can be wrong. Reading the version a human already wrote is less machinery and fewer ways to surprise someone.

Shape

release-oxc.yml gains a decide job; build, package and publish are gated on its outputs, and the tag/version check moves into it so it can also gate the run.

release-js.yml covers three packages, so its single package job became a matrix over whatever decide selected, and artifacts are named npm-package-<name> rather than one shared npm-package. Its decision is a small Node script rather than a case over the ref, because it now has to answer "which of these need releasing" instead of "which one did the tag name".

Verification

Both decision scripts were extracted from the YAML and run against the real npm registry across every path:

Case	Result
master push, oxc 0.2.3 not on npm	build=true publish=true
master push, both JS packages at 0.2.1 on npm	packages=[] any=false, build skipped
master push, simulated bump to solid-layouts 0.2.2	selects only that package
tag matching the version	selected, publish=true
tag disagreeing with the version	exits 1 with the expected-tag message
dispatch	selected, publish=false
dispatch of the private fixture	selected, publish=false

All three workflow files parse as YAML.

First run

Merging this releases solid-layouts-oxc@0.2.3, which is the compiler fix from #11 that is currently sitting unpublished on master. That is the intended first exercise of the path, and it is what unblocks @pathscale/ui picking the fix up.