fix(release): enforce binary version integrity pre/post publish

.github/workflows/release.yml

@@ -235,15 +235,23 @@ jobs:
         id: publish_npm
         if: steps.changesets.outputs.hasChangesets == 'false' && steps.publish_check.outputs.needs_publish == 'true'
         env:
-          NODE_AUTH_TOKEN: ""
+          NODE_AUTH_TOKEN: ''
           NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/trusted-npmrc
-          NPM_CONFIG_PROVENANCE: "true"
+          NPM_CONFIG_PROVENANCE: 'true'
         run: |
           npm install -g npm@^11
           npm --version
           printf "registry=https://registry.npmjs.org/\n" > "$NPM_CONFIG_USERCONFIG"
           pnpm ci:publish
 
+      - name: Verify published npm tarball
+        if: steps.publish_npm.outcome == 'success'
+        env:
+          PACKAGE_NAME: agent-browser-stealth
+          EXPECTED_VERSION: ${{ steps.publish_check.outputs.local_version }}
+        run: |
+          pnpm run verify:registry-host-binary
+
       - name: Set release outputs
         id: publish_metadata
         run: |
@@ -294,7 +302,7 @@ jobs:
         run: |
           VERSION=$(node -p "require('./package.json').version")
           TAG="v$VERSION"
-          
+
           # Check if release already exists
           if gh release view "$TAG" &>/dev/null; then
             echo "Release $TAG already exists, uploading binaries..."