Package release tarballs with dependencies

[chailandau]

Why

GitHub Release tarballs are used by package-manager installs, where invoking a registry during install can be brittle. Keep npm publishing unchanged while making the release archive self-contained for downstream package-manager consumers.

What

• Add a release-tarball packer that includes built Ghost output plus runtime dependencies
• Switch the automatic and manual GitHub Release tarball workflows to use that packer
• Add checks that the release tarball runs without installing dependencies
• Add a guard that the normal npm package tarball does not include node_modules

Risk Assessment

Low to medium: this changes only the GitHub Release archive shape, not the npm publish command or normal npm package contents. The new checks cover both sides of that boundary.

References

• pnpm build
• pnpm test
• pnpm check
• Direct npm pack inspection confirmed the normal npm tarball does not include node_modules

Generated with Codex