chore(release): bump to 0.1.3 and add a guarded release command

Bumps the seven version locations publish.yml pins against the tag:
the Cargo workspace (both crates inherit it), the npm package, the
native and wasm addon manifests, and the node binding plus its smoke
package. The captured 0.1.2 attestation fixtures in
verify-npm-provenance.test.mjs are historical data and stay put.

`pnpm release` tags the current commit and pushes it, which is the only
supported upload path: the workflow re-verifies the tag SHA, packs and
installs both artifacts, then publishes to crates.io over OIDC and to
npm with provenance. Publishing by hand would produce a registry entry
with different integrity and no attestation.

Every guard mirrors a check the workflow makes once the tag exists, so a
mismatch costs nothing instead of burning a tag: on main, clean tree,
HEAD identical to origin/main, all seven versions agreeing, and no such
tag locally or on origin.

Verified at 0.1.3: 238 Rust tests, clippy, fmt, cargo-deny, 5,679
conformance tests, coherent native and WASM artifacts, and both tiers
loaded from a packed tarball installed into an isolated prefix.

Author: metaphorics

Cargo.lock

@@ -5,7 +5,7 @@ members = ["crates/*"]
 [workspace.package]
 edition = "2024"
 rust-version = "1.88"
-version = "0.1.2"
+version = "0.1.3"
 license = "MIT"
 
 [workspace.lints.rust]

Cargo.toml

@@ -1,6 +1,6 @@
 {
   "name": "zod-rs-node",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": true,
   "napi": {
     "binaryName": "zodrs_node",

crates/zodrs-node/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "zodrs-node-smoke",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "napi": {
     "binaryName": "zodrs_node",
     "targets": ["x86_64-unknown-linux-gnu"]

crates/zodrs-node/package.json

@@ -6,6 +6,9 @@
   "engines": {
     "node": ">=20.17"
   },
+  "scripts": {
+    "release": "bash scripts/release.sh"
+  },
   "devDependencies": {
     "@napi-rs/cli": "3.8.6",
     "@emnapi/core": "1.11.3",

crates/zodrs-node/smoke/package.json

@@ -1,5 +1,5 @@
 {
   "name": "zod-rs-node",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": true
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "zodrs",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "TypeScript-first schema validation with static type inference, backed by a Rust core. Drop-in replacement for zod v4.",
   "repository": {
     "type": "git",

packages/zodrs/native/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod-rs-node-wasm32-wasi",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": true,
   "dependencies": {
     "@emnapi/core": "1.11.3",

packages/zodrs/package.json

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Tag the current commit and push the tag. Pushing a `v*` tag is the only
+# supported upload path: `.github/workflows/publish.yml` re-verifies the tag
+# SHA, packs, installs and checks both release artifacts, then publishes to
+# crates.io over OIDC and to npm with provenance.
+#
+# Every check here mirrors one the workflow makes after the tag exists. A tag
+# is effectively single-use for a release, so failing locally is free and
+# failing in CI is not.
+set -euo pipefail
+
+die() {
+	printf 'release: %s\n' "$1" >&2
+	exit 1
+}
+
+branch=$(git branch --show-current)
+[ "$branch" = "main" ] || die "releases run from main, not '$branch'"
+[ -z "$(git status --porcelain)" ] || die "working tree is not clean"
+
+git fetch --quiet origin main
+head=$(git rev-parse HEAD)
+remote=$(git rev-parse origin/main)
+[ "$head" = "$remote" ] ||
+	die "HEAD ($head) and origin/main ($remote) differ; push or pull first"
+
+# publish.yml pins the tag against all seven of these.
+version=$(node -p "require('./packages/zodrs/package.json').version")
+for pair in \
+	"packages/zodrs/native/package.json:native addon" \
+	"packages/zodrs/wasm/package.json:wasm addon" \
+	"crates/zodrs-node/package.json:node binding" \
+	"crates/zodrs-node/smoke/package.json:node smoke"; do
+	manifest=${pair%%:*}
+	found=$(node -p "require('./$manifest').version")
+	[ "$found" = "$version" ] || die "${pair#*:} is $found, expected $version"
+done
+workspace=$(python3 -c 'import tomllib; print(tomllib.load(open("Cargo.toml","rb"))["workspace"]["package"]["version"])')
+[ "$workspace" = "$version" ] || die "Cargo workspace is $workspace, expected $version"
+crate=$(cargo metadata --format-version 1 --no-deps |
+	jq -r '.packages[] | select(.name == "zodrs") | .version')
+[ "$crate" = "$version" ] || die "zodrs crate is $crate, expected $version"
+
+tag="v$version"
+if git rev-parse --verify --quiet "refs/tags/$tag" >/dev/null; then
+	die "$tag already exists locally"
+fi
+if [ -n "$(git ls-remote --tags origin "refs/tags/$tag")" ]; then
+	die "$tag already exists on origin"
+fi
+
+git tag -a "$tag" -m "$tag"
+git push origin "$tag"
+printf 'release: pushed %s at %s; publish.yml now verifies and uploads\n' "$tag" "$head"