[callumalpass]

Review fixes

Ops train/contract: https://github.com/mdbase-dev/mdbase-cloud-ops/pull/1335 (docs/weekly-app-repin.md).

• Verify every repinned npm package with pinned Sigstore 4.1.1 before manifest edits: trusted Fulcio certificate chain, GitHub OIDC issuer, CT/transparency-log inclusion, exact Connect repository, exact publisher workflow (publish-sdk-npm.yml for SDK, publish-npm.yml otherwise), and exact release tag ref. Require signed SLSA source commit to equal the production record for SDK and the other packages, exact npm subject/version and SHA-512 digest. Missing or invalid evidence fails closed.
• Download and hash the actual archive against that signed digest. After lockfile refresh, require each pinned entry's integrity and explicit tarball URL to match the verified artifact. This prevents a registry metadata change between preflight and resolution from silently changing deployed bytes. The bridge receipt lives only in runner temp; it is not an authorization record.
• Install tooling from the existing frozen pnpm lock with lifecycle scripts disabled. Add only the verifier dependency closure; preserve every existing importer, package and snapshot (no Electron or unrelated peer/dependency upgrade).
• Narrow production push triggers to explicit manifests of the deployed Reader workspace/dependency closure. Root lock-only edits and unrelated app/test manifests no longer trigger production. Manual/native paths remain unchanged.
• Only standalone CI owns the automatic LAB deployment; a reusable CI call from the production workflow cannot deploy LAB again.
• Preserve peer dependency ranges. Capture the URL from gh pr create directly for auto-merge instead of immediately querying the index again.

Split-pin decision / qualification status

This remains a reference under qualification, not an adopted unattended release. Staging and LAB SDKs remain separately byte-verified environment-specific originals: they embed different trust/origins and are selected without production fallback. The direct protocol original serves manifest-validation tooling; it does not override the SDK's bundled protocol. The ops contract documents the rationale.

Keeping these boundaries is deliberate, not proof of compatibility with the new npm SDK. The existing original-member/provenance checks are not bypassed: production npm intake must pass deliberate compatibility qualification before Reader can be called adopted. Extension version/tag/store publication remains outside this adoption PR. No SDK pin or vendor archive is actually changed by this tooling PR.

Validation

• rpnpm test:sdk-repin: 16 tests pass with a frozen install on Node 22.22.0 / pnpm 10.7.0. Covers signer policy, wrong repository/workflow/ref/source/digest/subject, missing provenance, archive tampering, lock tampering, peer preservation, atomic refusal/no-op, narrow triggers and direct PR URL capture.
• rpnpm lint:code: passes across Reader.
• Prettier checks all changed files and the lockfile; git diff --check passes. New repin workflow passes actionlint with ShellCheck; CI/deployment workflow expressions pass actionlint (the existing deployment ShellCheck unused-attempt warning is unchanged).
• Read-only smoke verifies actual beta.148 npm UI provenance and archive integrity; a corrupted real provenance signature is rejected. No new SDK/publication/production qualification is inferred from that old artifact.

PR-only: no merge, no auto-merge on this adoption PR, no publisher/deploy dispatch and no environment/release-record/secret/protection changes. Work remains in the temporary Reader clone, not a /home/calluma/projects checkout. GitHub CI on this head must finish before the handoff is called green.