Same flow as the crudy monorepo packages: test, then publish the package version unless the registry already holds it.
Ships pgmorbac 1.0.1 (is_allowed_nocache resolves roles once per org) and its 1.0.0 -> 1.0.1 upgrade script.
prepack downloads the release whose version matches package.json, verifies the Ed25519 manifest against the pinned release key and the zip against its sha256, and only then extracts the control file and scripts into sql/. No SQL is committed here.
marc