fix: harden publish verification and document fix for missing dist/loader.js

Co-authored-by: glittercowboy <186001655+glittercowboy@users.noreply.github.com>

.github/workflows/build-native.yml

@@ -173,11 +173,11 @@ jobs:
         run: npm run build
 
       - name: Verify dist exists
-        run: test -f dist/loader.js || { echo "::error::dist/loader.js missing after build"; exit 1; }
+        run: test -s dist/loader.js || { echo "::error::dist/loader.js missing or empty after build"; exit 1; }
 
       - name: Verify tarball contents
         run: |
-          npm pack --dry-run 2>&1 | tee /tmp/pack-output.txt
+          npm pack --dry-run --ignore-scripts 2>&1 | tee /tmp/pack-output.txt
           grep -q "dist/loader.js" /tmp/pack-output.txt || {
             echo "::error::dist/loader.js not in tarball"
             exit 1

CHANGELOG.md

@@ -23,6 +23,7 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - Eliminated branch checkout during slice merge that caused STATE.md conflicts (#307)
 - Removed infinite delivery retry loop for background job completions (#301)
 - Display ⌥ instead of Alt for keybindings on macOS (#299)
+- Publish verification checks `dist/loader.js` is non-empty (`-s`) and uses `--ignore-scripts` on `npm pack --dry-run` to match actual publish behaviour (#298)
 
 ### Removed
 - Deprecated legacy dead code from OAuth module