[jumski]

Summary

 local beta publisher
-  Bun Shell: stdin is a terminal, stdout/stderr are pipes
+  Bun.spawn: inherit stdin/stdout/stderr
   Changesets publish --no-git-tag -> npm publish
   nonzero exit -> existing registry-state probe

Preserve the terminal boundary so npm can offer browser authorization when the registry returns a web challenge, or prompt for an OTP otherwise. Document the explicit npm_config_browser="$PLANNOTATOR_BROWSER" override for agent-sandbox, including host/forwarded-browser routing. Keep account 2FA, confirmation guards, registry checks, cleanup, and stable OIDC releases unchanged.

No changeset: local release tooling, tests, and documentation only; no shipped plugin behavior or package API changes.

Evidence

• Before: the new real-PTY regression fails with {"stdin":true,"stdout":false,"stderr":false} using the original Bun Shell invocation.
  After: the same fixture passes with all three TTY flags true, --no-git-tag forwarded, and the browser override preserved.
• Nonzero child exit rejects into the existing publish-failure handling.
• bun run lint, bun run typecheck, bun run test (204 passed), bun run verify:pack, and git diff --check pass. Both new tests also pass on CI's Bun 1.3.11.
• Manual sandbox smoke: the patched launcher and installed npm web-challenge handler opened official npm documentation through the host-browser bridge; the human confirmed the tab opened. Challenge completion was simulated. No npm login, credential creation, registry write, or publication occurred. Live npm authorization remains untested.

Merge Danger

Door: two-way

Revert this commit to restore the previous publisher invocation. This PR does not publish a package or change authentication policy.

Blast Radius: local-release

Only the local beta publisher's terminal handling changes. Interactive authorization still depends on the challenge offered by npm and on an available browser bridge.