Moves the High release gate from the full-repository source scan to the binaries and exact npm archives prepared for publication. The full-repository SBOM and scan remain generated and available for review; Critical findings continue to fail that scan. The npm path now verifies, scans, and publishes the same archive bytes, while native publication scans the built executables and declared Zig runtime before Pantry runs.
Native scanner limitation: Syft does not infer components embedded in these Zig executables, so the native inventory binds executable hashes to the repository-declared Zig runtime version and retains the full-source report for review.
Validation: focused security/workflow tests, package tests, typechecks, Pickier, actionlint, isolated npm artifact scan, and macOS plus Linux/Windows binary scan rehearsals with a valid vulnerability database. No release or package was published in this PR.