ci(release): publish straight to latest; drop the dist-tag sync step

Two corrections to the release channel plan:

- An explicit --tag latest satisfies npm's prerelease guard (verified
  with publish --dry-run), so there is no need to publish under a
  separate bridge tag and sync latest afterwards.
- The sync step would have failed anyway: npm trusted publishing (OIDC)
  covers  only — bridge: 6.0.3-bridge.0.tsgo.7.0.2
latest: 6.0.3-bridge.0.tsgo.7.0.2 requires a registry token,
  which this workflow deliberately does not have.

latest is the release channel while the bridge line is the only real
content; the existing  tag remains as an alias for the
bridge.0 line.

Author: johnsoncodehk

.github/workflows/release.yml

@@ -173,34 +173,22 @@ jobs:
           set -euo pipefail
           for d in subpkgs/*; do
             echo "== publishing $(basename "$d") =="
-            (cd "$d" && npm publish --provenance --tag bridge)
+            (cd "$d" && npm publish --provenance --tag latest)
           done
         env:
           # Empty when the secret is unset: npm then falls back to OIDC trusted publishing.
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish main package
-        # --tag bridge: the version is a semver prerelease (x.y.z-bridge.N…);
-        # npm refuses to publish prereleases to the implicit `latest` tag.
-        run: npm publish --provenance --tag bridge
+        # --tag latest: the version is a semver prerelease (x.y.z-bridge.N…),
+        # so npm requires an EXPLICIT tag (default would be rejected), but an
+        # explicit `latest` is accepted. latest is the release channel until a
+        # stable line exists; `bridge` stays as an alias for the bridge.0 line.
+        run: npm publish --provenance --tag latest
         working-directory: staging
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-      - name: Point latest at the release
-        # The bridge line is the only real content today; keep `latest` in sync
-        # so bare `npm i` never resolves to a stale placeholder (issue #8).
-        # dist-tag add needs no OTP under trusted publishing/OIDC.
-        run: |
-          set -euo pipefail
-          V="$(node -p "require('./staging/package.json').version")"
-          npm dist-tag add "typescript-native-bridge@$V" latest
-          for p in darwin-arm64 darwin-x64 linux-x64 linux-arm64 linux-arm win32-x64 win32-arm64; do
-            npm dist-tag add "@typescript-native-bridge/$p@$V" latest
-          done
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
       - name: Create GitHub Release
         run: gh release create "${GITHUB_REF_NAME}" --generate-notes --verify-tag
         env: