Merge pull request #43 from bombshell-dev/preserve-npmignore

🐛 make sure not to forget .npmignore

Merge pull request #41 from bombshell-dev/staged-publishing

👷 Use staged publishing

fmt

Merge pull request #35 from thefrontside/infer-standard-schema-output

Infer parameter outputs from Standard Schemas

Merge pull request #19 from thefrontside/acronym-casing

preserve acronym casing

Merge pull request #9 from thefrontside/step-combinator

Step combinator

Merge pull request #7 from thefrontside/prefer-npm-deps

Prefer npm specifiers over jsr in import map

🐛 include validation issues in error when no input is provided

When a required field had no sources at all (no CLI args, env vars, or
defaults), the "none" source was not added to the sources array before
constructing the ValidationError, resulting in an empty error message.

👷remove registry-url to force github provenance auth

💚 verify JSR build before publishing

The verify-jsr job was only running `deno publish --dry-run` against the
raw source, but the actual publish-jsr job builds a versioned JSR
package first via `deno task build:jsr`. This means build failures
would slip past verification and only surface during the real publish,
defeating the purpose of the gate.