[jacebenson]

The release workflow could not land a release after #388 moved the package into cli/.

What broke

npm version only commits and tags when it runs from the repository root. The release job now has a job-level working-directory: cli, so npm version bumped cli/package.json and skipped the git step. The next line, git describe --tags --exact-match HEAD, then resolved to the docs-index-1-... tag that the docs snapshot workflow puts on a main commit.

Result on run 41247763328 (release_type=major): npm version printed v5.0.0, git push origin HEAD:main <docs-index tag> said Everything up-to-date, publish-prod was dispatched with the docs-index tag, and gh release create failed with Release.tag_name already exists. Nothing was published. npm latest stayed 4.5.1.

Fix

• Bump with npm --prefix cli version <type> --no-git-tag-version from the repo root, so the package files are updated and git is left alone.
• Commit cli/package.json and cli/package-lock.json and tag v<version> from the root.
• Read the tag from package.json instead of git describe, which can return any tag pointing at HEAD.

Evidence

Reproduced locally, both cases from a clean origin/main:

• Before: cd cli && npm version patch --tag-version-prefix=v prints v4.5.2, creates no commit and no tag, and git describe --tags --exact-match HEAD returns docs-index-1-...-e630e345...
• After, running the two new step scripts: version=5.0.0, tag=v5.0.0, commit chore: release v5.0.0, git tag --points-at HEAD shows v5.0.0, and publish-prod's tag == package.json version gate passes
• npm run lint in cli/: exit 0
• npm test in cli/: 1701 tests, 1699 pass, 1 fail, 1 skip. The failure is midserver-linux-remote.test.js running a real python3 subprocess under a fixture HOME; it fails the same way on unmodified main in this environment and CI is green on main, so it is not related to this change.

The 5.0.0 artifact also packs and installs clean: jsn version reports 5.0.0, and jsn --help, jsn docs --help, jsn setup --help, jsn auth status all run.

Merge danger

• Door: two-way. Workflow file only, no application code.
• Blast radius: the production release workflow. A bad edit here either fails to release or releases the wrong version, so it is gated by the tag-matches-package check in publish-prod.
• Rollback: revert the commit.

Limitations

• The fixed workflow is proven by the local step simulation, not by a real dispatch. Only a real release run proves it end to end.