test: add release preflight rehearsal

.github/workflows/macos-release-rehearsal.yml

@@ -0,0 +1,52 @@
+name: macOS Release Rehearsal
+
+on:
+  workflow_dispatch:
+    inputs:
+      check:
+        description: Rehearsal check to run
+        required: true
+        default: preflight-rejects-mismatched-tag
+        type: choice
+        options:
+          - preflight-rejects-mismatched-tag
+
+permissions:
+  contents: read
+
+jobs:
+  preflight-rejects-mismatched-tag:
+    if: ${{ inputs.check == 'preflight-rejects-mismatched-tag' }}
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: '22.14.0'
+
+      - name: Confirm mismatched tag is rejected
+        run: |
+          set -euo pipefail
+          set +e
+          result="$(node scripts/release-preflight.js --tag v0.0.0-beta.999 2>&1)"
+          status=$?
+          set -e
+          (( status != 0 )) || { echo "Mismatched release tag was accepted." >&2; exit 1; }
+          node - "$result" <<'NODE'
+          const result = JSON.parse(process.argv[2]);
+          if (result?.ok !== false || result?.error?.type !== "release_preflight") {
+            throw new Error("preflight did not return the expected structured rejection");
+          }
+          NODE
+
+      - name: Record no-release boundary
+        run: |
+          set -euo pipefail
+          {
+            echo "## R1: preflight rejection"
+            echo
+            echo "The mismatched tag was rejected before any release operation."
+            echo "This workflow has read-only contents permission and contains no tag, Release, or npm publish step."
+          } >> "$GITHUB_STEP_SUMMARY"