jst.compatibility.json.check, package dry run, browser matrix, benchmark, and generated npm/pnpm canary.create-jst through their tag-triggered OIDC workflows with provenance.Do not replace immutable tags or publish a compatibility row before the released artifacts pass the same gates as local source.