[jumski]

Summary

 publish -> verify npm metadata
-  wait up to 90 seconds
-  stale beta after success -> suggest changing dist-tag
+  share a five-minute polling budget across success/error outcomes
+  stale beta -> report unresolved publication; do not republish or retag
   latest drift -> stop immediately

Preserve the existing polling helper and release guards. Move failed-publish polling inside the registry-probe error boundary, add virtual-clock regression cases, and document read-only checks for unresolved registry state.

No changeset: local release tooling, tests, and docs only; no shipped plugin or package API changes. Follow-up to #88.

Evidence

• Before: production polling used a 90-second budget, so a version visible after two minutes could fail verification; the success path suggested changing the beta dist-tag while registry processing could still be pending.
  After: the production-budget regression tolerates two-minute visibility delay, latest drift stops without sleeping, and permanently stale metadata stops at the deadline.
• bun run lint, bun run typecheck, bun run test (207 passed), bun run verify:pack, and git diff --check pass. Existing real-PTY browser authorization regression still passes.
• Tests use virtual clocks and fixtures; no real npm publication or dist-tag mutation ran.

Merge Danger

Door: two-way

Revert the commit to restore previous polling and messages. This PR does not publish a package.

Blast Radius: local-release

A local beta publish can spend up to five minutes polling for metadata instead of 90 seconds. Registry-read failures remain errors; unresolved metadata no longer recommends a potentially unsafe retry or retag.