Release through dev, stage, prod and main, like every @beplus library, and publish to each CodeArtifact (v0.11.0)

[beplus-agent-claude]

Why. npm.beplus.cloud, dev's CodeArtifact, had served @beplus/be 0.7.0 as latest since July. be's release published only to public npm and GitHub Packages, and that repository has no upstream to npmjs (@beplus/be's origin controls block one).

Today that broke the estates' first P3 dev releases. release-deploy.mjs installs be after the buildspec has run beplus npm auth, so it got 0.7.0, whose be auto picks a Node version. It failed with did not find supported version of node in 'engines' field. The release failed safely: the service stayed on its previous revision.

What. be now releases the way every @beplus/* library does (setup-beplus's library-publish.yml): one version per commit, built once, promoted.

branch	a push
dev	packs the version once, tags vX.Y.Z with a GitHub pre-release, then publishes the tarball to GitHub Packages (dist-tag dev) and to dev's CodeArtifact (npm.beplus.cloud)
stage	publishes the bytes dev put in GitHub Packages to stage's CodeArtifact; GitHub Packages tags them stage
prod	the same into prod's CodeArtifact (GitHub Packages: latest), and the GitHub Release becomes a full release
main	the public channel, fast-forwarded from prod: the same bytes to public npm, with provenance

• The AWS role. Each environment's job assumes github-actions-beplus-be-<env>-npm-publishing in its GitHub environment's BE_AWS_ACCOUNT_ID, the same derivation library-publish uses.
• The registry. beplus aws codeartifact auth --env "$BE_ENVIRONMENT" picks the repository. scripts/release/check-environment.sh refuses to run without BE_ENVIRONMENT, because the CLI would otherwise fall back to dev.
• The refusals:
  • stage, prod and main refuse a version dev never released, meaning one that isn't tagged or isn't in GitHub Packages.
  • main refuses to be ahead of origin/prod.
• Re-runs are safe. Every publish is skipped when the registry already has that version.
• Branch flow.
  • PRs go into dev, now the default branch, and CI's Version check runs there.
  • bin/bump says so too.
  • scripts/install.sh clones main by name.
• This PR is the v0.11.0 test. bin/be is unchanged except for its VERSION. The rules are in docs/releasing.md.

Files

• .github/workflows/release.yml: jobs plan, then dev / promote / public.
• scripts/release/verify-version.sh: release <dev|stage|prod|main>.
• New helpers in scripts/release/: check-environment.sh, fetch-github-packages.sh and publish-codeartifact.sh.
• .github/workflows/ci.yml, bin/bump, scripts/install.sh, docs/releasing.md, .github/PULL_REQUEST_TEMPLATE.md.
• The v0.11.0 bump and CHANGELOG.md.

Checks run locally

• npm run lint (shellcheck) is clean.
• npm run test:host passes all 54 bats tests.
• verify-version.sh:
  • pr origin/dev → "Merging this PR releases @beplus/be@0.11.0 (0.10.0 → 0.11.0)."
  • release dev → need_release=true, need_github_packages=true.
  • release stage|prod|main before the release → refused: "v0.11.0 is not tagged, so dev never released…".
  • release main → refused, as a release runs only on dev, stage, prod or main.

After the merge

1. Check that dev's run is green, and that npm view @beplus/be version --prefer-online shows 0.11.0.
2. Promote one hop at a time, waiting for each run: git push origin origin/dev:stage, then origin/stage:prod, then origin/prod:main.
3. Retry the estates' failed Deploy actions.