[artiphishle]

Closes #703
Refs ankhorage/infra#477

Summary

• accept an empty npm release baseline only for an E404 from the public registry whose decoded request path exactly equals the release package name
• reject mismatched and unrelated 404 responses, authentication failures, unavailable registry responses, and malformed evidence
• synchronize the managed release workflow and existing CI workflow drift

Architecture

The behavior remains in the managed release-template edge; its executable regression test runs the rendered shell step with deterministic npm fixtures.

Release

• patch Changeset included for @ankhorage/devtools

Validation

• bun test src/tools/workflows/versionRollbackPolicy.test.ts
• bun run build
• bun run check-types
• bun run lint (existing warnings only)
• bun run knip:check
• bun run test (194 pass)
• bun run changeset:status
• bun run format
• bun run format:check
• bun ./dist/cli/bin/repository.js workflows status .