fix(github): download release helper scripts to $RUNNER_TEMP instead of the checkout

[bwp91]

The problem

The publish job fetches its helper scripts into .github/scripts/ inside the checkout, then runs npm publish. That fires the consuming repo's prepublishOnly hook, which is usually npm run lint && npm run build. So the downloaded scripts get linted as if they were the repo's own source.

Two of them (npm-version-script-auto.cjs, npm-version-script-esm-auto.js) are tab-indented. Any consumer whose lint config disallows tabs fails at exactly this point — after the GitHub release and tag have been created, but before npm publish runs.

That happened today on august-yale and rainbird:

• august-yale — tag and release v1.2.8 exist, npm is still on 1.2.7
• rainbird — tag and release v1.2.15 exist, npm is still on 1.2.14

It is an awkward failure to catch, because it is invisible until you release. A local npm run lint passes and the CI lint job passes, since both only ever see whatever copy is committed in the repo. The bad copy exists solely inside the release run.

Also worth knowing

Because these files land in the working tree before packing, they end up in the published tarball. august-yale@1.2.7 and rainbird@1.2.14 both ship a full .github/ directory to npm, release scripts included.

The change

Fetch into $RUNNER_TEMP/release-scripts/ and run from there, so nothing lands in the checkout. $RUNNER_TEMP is stable for the lifetime of a job, so the download-then-use step pairs still work.

This also removes the coupling in the other direction: consumers no longer need to keep their own copies of these scripts lint-clean.

Scope

publish-release.yml only.

• update-version.yml writes into the checkout too, but that job never publishes, so nothing lints what it downloads. Its pre-commit input is also a workspace-relative path handed to TriPSs/conventional-changelog-action, which would need care to move. Left alone deliberately.
• promote-branch.yml runs .github/scripts/npm-version-script-* without downloading it, relying on the consuming repo having committed a copy. That is a separate latent issue and is not touched here.

Verification

Ran the changed step verbatim against a real package.json + lockfile with RUNNER_TEMP set to a non-/tmp path: the script downloads, executes, resolves 1.2.7 from npm, bumps package.json to 1.2.8, exits 0, and leaves the working tree with only package.json and package-lock.json in it.

Reproduced the original failure first, by dropping the current upstream npm-version-script-esm-auto.js into a plugin checkout and running its lint script — 275 errors, all style/no-tabs and style/indent.

Merge order

Independent of #48, #49 and #50 — different lines. #48 also touches this file, but only uses: lines, so no conflict either way.