ci: lengthen npm registry verify retry window (#114)

* ci: lengthen npm registry verify retry window

Give Verify package.json version resolves on npm ~20 minutes
(40 attempts, 30s apart) and raise the job timeout so that
wait can finish after a slow registry propagation.

Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>

* chore: refresh artifact source snapshot after release.yml change

Rebuild so the committed agent-bundle manifest records the updated
sha256 for .github/workflows/release.yml.

Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>

Author: ScriptedAlchemy

.github/workflows/release.yml

@@ -17,7 +17,8 @@ concurrency:
 jobs:
   release:
     runs-on: ubuntu-26.04
-    timeout-minutes: 15
+    # Allow ~20 minutes of npm registry propagation retries after publish.
+    timeout-minutes: 35
     steps:
       - name: Check out the repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -82,13 +83,15 @@ jobs:
           set -euo pipefail
           name=$(node -p "require('./package.json').name")
           version=$(node -p "require('./package.json').version")
-          for attempt in 1 2 3 4 5 6 7 8; do
+          # npm can take several minutes to show a just-published version.
+          # Retry for ~20 minutes (40 × 30s) before failing.
+          for attempt in $(seq 1 40); do
             if [ "$(npm view "$name@$version" version 2>/dev/null || true)" = "$version" ]; then
               echo "registry $name@$version"
               exit 0
             fi
             echo "attempt $attempt: $name@$version not on npm yet"
-            sleep 15
+            sleep 30
           done
           echo "::error::$name@$version is not on npm; the release did not publish."
           exit 1