pnpm's trustPolicy: no-downgrade ranks staged publish above trusted
publishing and compares a version with every version of the package
published before it, not only its own major. pnpm and @pnpm/exe have
been staged since 11.21.0, so a v10 release published through plain
trusted publishing is still rejected as a trust downgrade.
pnpm and @pnpm/exe now go through the same staging script main uses for
v11: CI stages them through OIDC with no static token, and a maintainer
approves each stage with interactive 2FA. The platform packages were
never staged and stay on tokenless trusted publishing. Every publish now
passes --provenance, because the check only counts trusted publishing
when a provenance attestation is present.
Related to pnpm/pnpm#16319.
Zoltan Kochan
5aefcb2970