ci: fail publish pipeline loudly on registry/auth/network errors

The publish-npm step ended with `|| echo "[publish] Some packages may
already exist at this version — continuing"`, which unconditionally
converted any failure into success. That fallback silently masked a
real Gitea registry 404 during the @mosaic/* → @mosaicstack/* org
rename — CI reported green for pipelines #681 and #684 while every
single @mosaicstack/* publish fell on the floor, blocking users from
installing the gateway.

Replace the blanket swallow with a targeted rule:

- `E404 / E401 / ENEEDAUTH / ECONNREFUSED / ETIMEDOUT / ENOTFOUND` →
  FATAL, fail the pipeline. These are real registry/auth/network
  problems that must surface.
- `EPUBLISHCONFLICT / cannot publish over / previously published` →
  tolerate. This is the legitimate "only some packages were bumped in
  this merge" case and should not block CI.
- Any other unrecognized failure → FATAL (fail closed, not open).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.woodpecker/publish.yml

@@ -35,13 +35,36 @@ steps:
       - |
         echo "//git.mosaicstack.dev/api/packages/mosaicstack/npm/:_authToken=$NPM_TOKEN" > ~/.npmrc
         echo "@mosaicstack:registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/" >> ~/.npmrc
-      # Publish non-private packages to Gitea (--no-git-checks skips dirty/branch checks in CI)
+      # Publish non-private packages to Gitea.
-      # --filter excludes web (private)
+      #
-      - >
+      # The only publish failure we tolerate is "version already exists" —
-        pnpm --filter "@mosaicstack/*"
+      # that legitimately happens when only some packages were bumped in
-        --filter "!@mosaicstack/web"
+      # the merge. Any other failure (registry 404, auth error, network
-        publish --no-git-checks --access public
+      # error) MUST fail the pipeline loudly: the previous
-        || echo "[publish] Some packages may already exist at this version — continuing"
+      # `|| echo "... continuing"` fallback silently hid a 404 from the
+      # Gitea org rename and caused every @mosaicstack/* publish to fall
+      # on the floor while CI still reported green.
+      - |
+        set +e
+        pnpm --filter "@mosaicstack/*" --filter "!@mosaicstack/web" publish --no-git-checks --access public 2>&1 | tee /tmp/publish.log
+        EXIT=${PIPESTATUS[0]}
+        set -e
+        if [ "$EXIT" -eq 0 ]; then
+          echo "[publish] all packages published successfully"
+          exit 0
+        fi
+        # Any hard registry/auth/network error fails the pipeline.
+        if grep -qE "E404|E401|ENEEDAUTH|ECONNREFUSED|ETIMEDOUT|ENOTFOUND" /tmp/publish.log; then
+          echo "[publish] FATAL: registry/auth/network error detected — failing pipeline" >&2
+          exit 1
+        fi
+        # Tolerate only the specific "version already published" case.
+        if grep -qE "EPUBLISHCONFLICT|cannot publish over|previously published" /tmp/publish.log; then
+          echo "[publish] some packages already at this version — continuing (non-fatal)"
+          exit 0
+        fi
+        echo "[publish] FATAL: publish failed with unrecognized error — failing pipeline" >&2
+        exit 1
     depends_on:
       - build