dc
d07151fbf5
client/.npmrc is tracked now, and every workflow appended the NPMRC secret to it inside the workspace - one `git add -A` from committing a live token, and semantic-release runs in jobs that have already written it. The secret goes to $RUNNER_TEMP/npmrc and NPM_CONFIG_USERCONFIG points the installs at it, so the project file stays policy-only. The archiver guard used a fixed path in the shared tmpdir and had no handler on the write stream: two jobs on one runner collided on the path, and a write failure surfaced as an uncaught throw. Each run now gets its own directory, both streams report, and the tree is removed afterwards. The exceljs override pins archiver to 8.0.0 rather than ^8.0.0, so the version the guard was validated against cannot drift.