docs(decisions): Add ADR 0082 pinning the publish-stage npm CLI version

[yunseo-kim]

Summary

Adds ADR 0082, deciding that the publish-stage npm CLI is provisioned as an explicitly pinned, integrity-verified distribution selected from a reviewed allowlist, replacing the current floating node-24-bundled npm on the publish job only. Build-stage npm selection is unchanged and remains governed by ADR 0016/0017/0027.

• What changed?
  • New ADR 0082: pin the publish-stage npm CLI version with integrity-verified provisioning (version + distribution SHA-256 in the publish job), a reviewed allowlist recorded in the specification, and a bump procedure requiring an npm-internals diff-review checklist (oidc.js flow, buildMetadata() branch structure, @npmcli/config exclusive enforcement, publishConfig flatten timing, sigstore-js major) plus per-version compatibility fixtures.
  • Publish-side contract change (implementation lands with the npm trusted publishing auto-enables provenance and discards the --provenance-file bundle (dogfood 4 read-back failure) #97 fix): the publish job's npm validates against the allowlist pin, replacing the current exact-equality check against the build-time runtime.npm_version record, since build npm (toolchain, floating) and publish npm (pinned) diverge by design. Build continues recording its actual npm in runtime.npm_version.
  • Relations updates (frontmatter only; accepted ADR bodies untouched): partially-supersedes ADR-0027 scoped to the publish-stage npm provisioning clause (reverse edge added), see-also ADR 0016/0017/0029/0081 (reverse edges added).
  • Index rows for 0082 in docs/decisions/README.md and README.ko.md.
• Why is this needed?
  • The npm trusted publishing auto-enables provenance and discards the --provenance-file bundle (dogfood 4 read-back failure) #97 remediation mechanism depends on npm internals that already vary across the currently allowed range (11.5.1 / 11.17.0 / 12.0.2: oidc.js structure, exclusive env carve-out, sigstore-js v3–v5). The fourth dogfood showed fail-closed read-back protects acceptance but not registry state (@windlass/vers-js@0.1.2 is permanently burned). A floating toolchain under a source-dependent publish mechanism leaves the verification surface open, and a node-24 image update is a correlated-failure vector for all callers. The decision completes the builder-owned npm principle (ADR 0016/0017) and ADR 0027's recorded pinned-setup intent on the publish path, and makes the specification's per-version fixture obligation satisfiable. Upstream fix: provenance-file takes precedence over OIDC auto-generated provenance npm/cli#9882 adoption becomes a deliberate pinned bump.
• Scope note (from review): an earlier draft pinned npm across all jobs; per reviewer decision the pin is publish-only, and a manifest-selected build npm option was considered and excluded from this ADR (build-stage selection may be revisited by a separate future decision).
• How to test: documentation-only; adr-relations-check passes (83 ADRs, 184 edges, NO PROBLEMS); prettier and markdownlint clean.

Related Issues

• Related npm trusted publishing auto-enables provenance and discards the --provenance-file bundle (dogfood 4 read-back failure) #97 (motivating defect), [P06] Live M1 dogfood #30 (dogfood evidence)

Change Type

• Documentation

Changelog

• Category: None
• User-facing note: Architecture decision record; no runtime behavior change in this PR (spec amendments and provisioning changes follow in the npm trusted publishing auto-enables provenance and discards the --provenance-file bundle (dogfood 4 read-back failure) #97 fix implementation).

Changelog update:

• Not needed because this change is not user-facing

Checklist

General

• PR title follows Conventional Commits format: type(scope): Summary
• This PR does not expose backend/internal implementation details in a public repo.
• No secrets, tokens, keys, or private endpoints are included.
• Changes stay within this repository's intended scope.

Protocol / Compatibility Impact

• No protocol/spec impact in this PR; ADR 0082's consequences (spec allowlist, publish-side pin validation, provisioning) land in the follow-up implementation PR.

Testing

• Lint and format pass
• Manual verification performed

Describe test evidence: adr-relations-check reports 83 ADRs / 184 edges / NO PROBLEMS; prettier and markdownlint clean on docs/decisions/; verified via git diff that existing ADRs changed only in frontmatter relations (bodies immutable per convention).

Documentation

• Spec/docs updated (this PR is the ADR; index READMEs updated in both languages)
• Changelog decision completed above

Rollout / Risk

• Risk level: Low (documentation only)
• Rollback plan: revert this branch.

Reviewer Checklist

• Scope is clear and minimal
• Security and boundary checks passed
• Tests and docs are sufficient
• Compatibility impact is correctly handled