fix(release): make gitHead verification optional for tarball-published artifacts

Publishing an explicit tarball does not automatically populate the npm registry gitHead metadata field. This relaxes the script to verify gitHead only if the registry populated it, so GitHub Release creation is not blocked.

Author: yiaany

scripts/verify-published.mjs

@@ -14,10 +14,12 @@ for (let attempt = 1; attempt <= 6; attempt += 1) {
         encoding: "utf8",
       }),
     );
-    if (metadata.version !== packageJson.version)
+    if (metadata.version !== packageJson.version) {
       throw new Error(`registry version is ${metadata.version}`);
-    if (metadata.gitHead !== expectedSha)
-      throw new Error(`registry gitHead is ${metadata.gitHead ?? "missing"}`);
+    }
+    if (metadata.gitHead && metadata.gitHead !== expectedSha) {
+      throw new Error(`registry gitHead is ${metadata.gitHead}`);
+    }
     console.log(`Verified ${spec} at ${expectedSha}.`);
     process.exit(0);
   } catch (error) {