Nightly Publish Should Block on Validate

[thecodedrift]

These run in parallel:

• Release CLI Nightly / Publish the nightly to npm (push)
• Validate

And they really shouldn't. We should only be publishing if Validate passes, meaning it builds and tests cleanly

[thecodedrift]

Concrete evidence this is live, from main today — the two runs are 26 seconds apart on the same commit:

Commit	Validate	Nightly published
3f114d6	failure at 00:24:27	0.11.0-20260821002453x3f114d6 at 00:24:53

@taskless/cli-nightly@0.11.0-20260821002453x3f114d6 is on npm now, holds dist-tags.latest, and was built from a commit whose Validate never passed. Anyone who ran npx @taskless/cli-nightly in that window got it.

The failing step in that case was Check for unarchived OpenSpec changes on main, which is a repo-hygiene gate rather than a broken build — so the artifact itself was probably fine. That is worth saying plainly, because it is the only reason this has not already shipped something broken: nothing about the current arrangement distinguishes "main is red for a bookkeeping reason" from "main is red because the tests fail." Both publish.

That hygiene failure is now fixed (423363a) and main is green, so the window is closed for the moment — but only by accident of what happened to be red.

One thing to weigh in the design: Validate and the nightly currently start in parallel, so gating one on the other adds the full Validate wall-clock to every nightly. That is the intended trade, but it does mean the nightly stops being near-immediate after a merge. Worth stating in the PR body so the latency change is a decision rather than a surprise.