pnpm publish runs no build. apps/cli has no prepack, prepare or
prepublishOnly hook, and the npm lifecycle never invokes a plain
`build` script, so in a clean CI checkout `files: ["dist"]` matched an
empty directory. v0.2.0 shipped a package.json and a LICENSE, nothing
else, and npm reported it as a clean publish.
The old "Validate packaging" step could not catch this: `publish
--dry-run` packs that same empty tarball and exits 0.
Both lanes now build explicitly and then run scripts/verify-tarball.sh,
which packs for real and asserts dist/index.js, both vendored IIFEs and
the three woff2 fonts are present, with a floor on total size.
Nayan
ae8194f5e8