fix(release): pass an explicit npm dist-tag, stop tee masking a failure

[duguankui]

Two defects in release.yml's Publish pre-release Angular package to GitHub Packages step. Neither has surfaced yet because the workflow has not been tagged since — the next v* tag would have hit both.

1. The publish would have failed on its dist-tag

npm/cli now refuses a version carrying a SemVer pre-release suffix when its dist-tag is left at the default:

npm error You must specify a tag using --tag when publishing a prerelease version.

The check is isDefault('tag') && !manifest.publishConfig?.tag — whether --tag was passed at all, not what it was set to. Every version this step publishes is a pre-release (the step is gated on channel == 'preview'), so the next tagged run would have stopped here after the NuGet packages had already been pushed.

That is not hypothetical — it is exactly how v0.5.0-preview.3 failed in vault-extract today, leaving that version published on the NuGet channel only and forcing a re-cut as 0.5.0-preview.4. abp-modules was never exposed: both of its publish steps already pass --tag.

--tag latest, not steps.channel.outputs.npm-tag (which is next on this branch). GitHub Packages only ever receives pre-releases here — stable goes to npmjs under the public @dignite/* name — so latest tracking the newest preview is what a consumer of this channel wants, it keeps an unpinned install resolving, and it stops the latest tag that earlier untagged publishes already set from freezing on a stale preview.

2. A failed publish was reported as a green step

The publish ran as:

if ! npm publish "$workdir/package" --registry https://npm.pkg.github.com 2>&1 | tee /tmp/npm-publish.log; then

The step shell is bash -e with no pipefail, so the pipeline's status is always tee's — zero. The if ! branch could never fire: the "already published" soft skip was unreachable, and a real failure (an E401, or the --tag error above) would have passed as success. Same bug vault-extract's release workflow shipped and fixed; this is the same fix — redirect to the log, test npm's own exit status, and propagate it (exit 1 → exit $status).

Verification

The workflow file parses, and the step's run block carries --tag latest, no live tee pipeline, and exit $status. verify-packed-npm-install.sh is unaffected: it installs the exact version (npm:@dignite-projects/ng.site@${version}), never a dist-tag.

CHANGELOG entry added under [Unreleased] / Fixed.