fix(monorepo-preview-release): don't pollute npm latest on first publish + stream pnpm output

[rqbazan]

Context

Spotted on variableland/dx#244: the preview-release of the brand-new @rrlab/vitest-plugin published fine, but its npm latest dist-tag ended up pointing at the PR preview 0.0.1-git-9a2ee7f.0.

npm force-assigns latest to a package's first-ever publish, even when the publish used --tag pr-<n>. So a brand-new package's preview build silently becomes the version pnpm add <pkg> (no tag) resolves to — until a real release re-points latest. No flag at publish time prevents this; it has to be corrected afterwards.

Changes

• Fix latest pollution. Capture which packages are first-time publishes (checked before publishing) and run pnpm dist-tag rm <pkg> latest afterwards. Best-effort — warns instead of failing if the registry refuses. Result: only pr-<n> remains, pnpm add <pkg> fails loudly instead of installing a PR build, and <pkg>@pr-<n>/exact-version installs keep working. Self-heals once a stable release runs.
• Stream pnpm output. New runLogged helper streams the mutating commands (pnpm version/publish/dist-tag) to the Actions log in collapsible groups while still capturing output for error context. JSON query commands (list/view) stay silent so their parsed output isn't corrupted. tinyexec consumes child streams once, so we capture during iteration and read proc.exitCode after.
• firstTime in the vland-bot payload. Each package entry now carries firstTime: boolean so the PR comment can flag previews whose latest was just removed. (Bot-side consumption tracked separately in vland-bot.)
• core.setSecret(npm_token) to mask any accidental echo (makes the README's existing security claim true).
• README updated (payload table, "First-time publishes & latest" section, logging behavior).

Verification

• tsc --noEmit clean; biome check clean.
• dist/ rebuilt via ncc.
• Validated the tinyexec streaming assumption empirically (iteration streams stdout+stderr, exitCode populated after the loop, non-zero exit doesn't throw).

Not retroactive

@rrlab/vitest-plugin@latest still points at the PR #244 preview. Clean up with pnpm dist-tag rm @rrlab/vitest-plugin latest (token with @rrlab scope rights), or let it self-correct when the package gets its first stable release.

🤖 Generated with Claude Code