Verify pub score and make releases idempotent

[KickNext]

What changed

• run the latest pana analyzer in CI and require zero missing pub points
• detect versions already present on pub.dev before OIDC publication
• allow the first manually published version to create its GitHub Release without a duplicate upload

Why

pub.dev requires the first package version to be published manually. This keeps the tag workflow idempotent for that first release and for reruns.

Verification

• dart pub publish --dry-run: 0 warnings
• actionlint
• CI will execute pana on Ubuntu

[chatgpt-codex-connector]

💡 Codex Review

morphnext/.github/workflows/publish.yml

Line 102 in 6d2f2cf

gh release create "${GITHUB_REF_NAME}"

Skip creation when the GitHub release already exists

When this tag workflow is rerun after a previous successful release, check-version reports the package as published, publish is skipped, and the new release condition deliberately proceeds to this command. However, gh release create --help defines the command as creating a new release rather than updating or ensuring one, so creating the same tag's release again fails with an already-exists validation error and leaves the supposedly idempotent rerun red. Check gh release view first or explicitly tolerate an existing release.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[KickNext]

Fixed in 6aba7b0: the release job now checks gh release view and treats an existing release as success before attempting gh release create.