A Release Pipeline With No Long-Lived Tokens and No Silent Tampering

How I secured the Hookie CLI release pipeline with OIDC trusted publishing, staged npm releases behind 2FA, and immutable GitHub release assets.