Greptile Summary

This PR fixes two publish regressions: npm rejecting v-prefixed semver tags (e.g. v2026.5.16) and OTP retry not triggering on npm's one-time pass challenge wording.

• Semver normalization: normalize_publish_version strips the v prefix via node_semver, applied to the pre-flight version check, registry PUT metadata (dist-tags, versions key, _id, version field), tarball filename, and — via build_archive_for_publish + data_override — the embedded package/package.json bytes inside the .tgz, making the tarball self-consistent with what npm would produce.
• OTP detection: Adds "one-time pass" and "one time pass" as additional trigger substrings alongside the existing "one-time password" / "one time password" variants.
• Test hardening: deploy.bats assertions switch from "is not" to "empty" to survive miette line-wrap when temp-dir paths grow long enough to push "not" onto its own line.

Confidence Score: 5/5

Safe to merge — the normalization path is publish-only, the plain aube pack code path is unchanged, and the three new behaviors are each independently tested.

All changed code paths are narrowly scoped: normalization only fires when a v-prefix is present, the data_override mechanism does not alter the on-disk file, and the OTP substring additions are additive. The test suite covers the introduced code branches end-to-end. No regressions are visible in the existing paths.

No files require special attention.

Important Files Changed

_{Reviews (5): Last reviewed commit: "test(deploy): tolerate wrapped empty mes..." | Re-trigger Greptile}