feat(registry): add create-only delegated publishing

[ascorbic]

What does this PR do?

Implements delegated release work items W1.6 and W1.7:

• Exposes the active release collection and exact create-only OAuth scope as one typed contract.
• Adds a narrow createDelegatedRelease() API that performs exactly one immutable release create and exposes no broader write operations.
• Validates and snapshots release inputs, then verifies the exact returned AT URI and recomputed canonical DAG-CBOR CID.
• Documents that a stable release NSID migration requires publisher reauthorization.

Part of #1908.

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (not applicable, no admin UI strings)
• I have added a changeset (if this PR changes a published package)
• New features link to an approved Discussion: not applicable, this merge unit implements the approved delegated-release RFC and integration plan in RFC: Attested Automated Publishing #1870 and Delegated release service #1908.

AI-generated code disclosure

• This PR includes AI-generated code, model/tool: OpenCode with GPT-5.6 Sol, adversarial review with Claude Opus 4.8

Screenshots / test output

• pnpm build
• pnpm typecheck
• pnpm lint:quick
• pnpm lint:json
• pnpm --filter @emdash-cms/registry-client test (112 passed)
• pnpm --filter @emdash-cms/registry-lexicons test (19 passed)
• publint passes for both changed packages. attw --pack crashes internally with Cannot read properties of undefined (reading filename) after packing either package.

---

Try this PR

Open a fresh playground →

A full working EmDash site, deployed from this branch. Each visit gets its own session-scoped sandbox: no login needed and no shared state. Try the admin, edit content, hit the public site.

_{Tracks feat/delegated-release-service-18-create-only-publishing. Updated automatically when the playground redeploys.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 136edea

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@emdash-cms/registry-client	Minor
@emdash-cms/registry-lexicons	Minor
@emdash-cms/admin	Patch
emdash	Patch
@emdash-cms/plugin-cli	Patch
@emdash-cms/registry-verification	Patch
@emdash-cms/cloudflare	Patch
@emdash-cms/sandbox-workerd	Patch
@emdash-cms/fixture-perf-site	Patch
@emdash-cms/perf-demo-site	Patch
@emdash-cms/cache-demo-site	Patch
@emdash-cms/do-demo-site	Patch
@emdash-cms/do-solo-demo-site	Patch
@emdash-cms/auth	Patch
@emdash-cms/blocks	Patch
@emdash-cms/gutenberg-to-portable-text	Patch
@emdash-cms/x402	Patch
create-emdash	Patch
@emdash-cms/auth-atproto	Patch
@emdash-cms/plugin-embeds	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-cache	136edea	Jul 12 2026, 07:56 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-do	136edea	Jul 12 2026, 07:56 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-playground	136edea	Jul 12 2026, 07:55 PM

[emdashbot]

This is a well-scoped, additive change for the delegated-release RFC. The approach is the right one: instead of reusing the broad PublishingClient, it exposes a narrow, single-purpose createDelegatedRelease() API that only performs one immutable record create, validates inputs client-side, snapshots them to avoid TOCTOU, and verifies both the returned AT URI and the recomputed DAG-CBOR CID. The permission helper getDelegatedReleasePermission() keeps the active collection and exact OAuth scope in one typed, frozen contract so clients don't hard-code experimental NSIDs.

I reviewed the diff statically (no tooling run). The new code is consistent with the existing registry-client architecture: it uses the same Client/ok pattern as PublishingClient, imports semver/functions/valid.js the same way env/index.ts already does, and lists the atcute externals in tsdown.config.ts. Test coverage is solid for the happy path, pre-request validation, snapshot isolation, identity/CID mismatch, and the frozen permission shape.

I didn't find any blocking issues, AGENTS.md violations, or security gaps. No line comments needed.