Make package publication retries hash-safe

docs/PACKAGE_REGISTRY_RELEASES.md

@@ -43,6 +43,13 @@ the source tag, source commit, filename, size, and SHA-256 in
 same package version, so correction requires a new version rather than artifact
 replacement.
 
+A retry after partial publication is safe. Before upload, the workflow reads the
+native package registry file record and compares its SHA-256 with the artifact
+rebuilt from the protected tag. An exact existing artifact is skipped; a
+same-version artifact with another digest or an unexpected file set fails
+closed. This permits a failed npm publication to resume without weakening
+package immutability or accepting `--skip-existing` blindly.
+
 The npm tarball is always published through an explicit local `./dist/...`
 path. Without that prefix, npm may interpret a relative tarball name as a Git
 package shorthand before it ever contacts the configured registry.