docs(decisions): Add ADR 0083-0085 pinning the npm CLI toolchain across build and publish stages

[yunseo-kim]

Summary

• What changed: three architecture decision records completing the npm CLI version-pinning decision chain for the JS/TS npm package profile:
  • ADR 0083 — defer the npm M1 publish remediation (npm trusted publishing auto-enables provenance and discards the --provenance-file bundle (dogfood 4 read-back failure) #97) to the upstream fix: provenance-file takes precedence over OIDC auto-generated provenance npm/cli#9882 fix; the first reviewed npm release containing the fix becomes the initial publish npm pin, with an explicit revisit trigger (unmerged close, materially different precedence semantics, or no merge by 12026-10-01).
  • ADR 0084 — select the publish-stage npm provisioning mechanism: download the exact recorded registry tarball URL, verify the committed SHA-512 digest (SRI form, byte-identical to the registry-native dist.integrity) over the compressed bytes before extraction, and execute via a basename-npm launcher. Partially supersedes ADR 0082's SHA-256 designation; amends its open mechanism choice.
  • ADR 0085 — pin the build-stage toolchain pair: the reusable workflow resolves Node.js to an exact 24 patch recorded together with the npm version that patch bundles, and each job that uses the bundled npm asserts node --version/npm --version equality with the recorded pair before the first npm invocation. Partially supersedes ADR 0027's floating toolchain resolution clause only.
• Why is this needed: the fourth M1 dogfood (npm trusted publishing auto-enables provenance and discards the --provenance-file bundle (dogfood 4 read-back failure) #97) showed a floating npm on the publish path can publish-then-reject and permanently burn version numbers. ADR 0082 pinned the publish npm and deliberately left two questions open — what the npm trusted publishing auto-enables provenance and discards the --provenance-file bundle (dogfood 4 read-back failure) #97 fix is (settled by 0083), which mechanism provisions the pin (settled by 0084) — plus the build-stage version selection review (settled by 0085 with an escalation trigger toward an independently provisioned build npm).
• How to test: documentation-only change. Validation evidence below.

Related Issues

• Related npm trusted publishing auto-enables provenance and discards the --provenance-file bundle (dogfood 4 read-back failure) #97 — this PR records the remediation decisions; implementation lands when the fixed npm release ships (ADR 0083 deferral scope), so npm trusted publishing auto-enables provenance and discards the --provenance-file bundle (dogfood 4 read-back failure) #97 stays open.
• Related [P06] Live M1 dogfood #30 — dogfood attempt evidence referenced by the ADRs.

Change Type

• Bug fix
• Feature
• Refactor
• Documentation
• Test/CI
• Breaking change
• Other:

Changelog

• Category: None
• User-facing note: Architecture decision records only — no user-facing behavior changes. The implementing specification, workflow, and Go changes land later under ADR 0083's deferral scope and ADR 0085's own schedule.

Changelog update:

• CHANGELOG.md [Unreleased] updated
• Not needed because this change is not user-facing

Checklist

General

• PR title follows Conventional Commits format: type(scope): Summary
• This PR does not expose backend/internal implementation details in a public repo.
• No secrets, tokens, keys, or private endpoints are included.
• Changes stay within this repository's intended scope.

Protocol / Compatibility Impact

• No protocol/spec impact
• Protocol/spec updated
• Conformance tests updated
• Breaking change is versioned and migration notes are included

ADR texts only; no specification files are modified. Each ADR records which future specification amendments it governs.

Testing

• Unit tests added/updated
• Integration or conformance tests added/updated
• Tests pass
• Lint and format pass
• Type check passes
• Manual verification performed

Describe test evidence:

• prettier --write on all touched files: clean.
• markdownlint-cli2 docs/decisions/**/*.md: 89 files, 0 errors.
• python3 .agents/skills/adr-relations-check/scripts/check_relations.py: 86 ADRs, 216 edges — NO PROBLEMS (forward + reverse relation edges symmetric, status grammar valid).
• Lefthook pre-commit (prettier, markdownlint) and commit-msg (dco-signoff) passed on all three commits.

Documentation

• README updated — docs/decisions/README.md and README.ko.md sequence, inventory, and traceability tables (bilingual, same change).
• Spec/docs updated — three new ADRs; reverse relation edges added to ADR 0016/0017/0027/0067/0082/0083/0084; docs/decisions/AGENTS.md index updated.
• Changelog decision completed above

Rollout / Risk

• Risk level: Low — documentation-only; no runtime, workflow, or specification behavior changes.
• Rollback plan: revert the merge commit; ADR 0065's immutability rule applies after acceptance, so any post-merge decision change would be a new ADR instead.

Reviewer Checklist

• Scope is clear and minimal
• Security and boundary checks passed
• Tests and docs are sufficient
• Compatibility impact is correctly handled