Add verified release shipping script

scripts/ship-release.mjs

@@ -0,0 +1,36 @@
+import { spawnSync } from 'node:child_process';
+
+const qaVersion = process.env.PUBLIC_QA_VERSION ?? makeQaVersion();
+
+runPnpmScript('verify:local-release');
+runPnpmScript('deploy:nas');
+runPnpmScript('verify:public-deploy', { PUBLIC_QA_VERSION: qaVersion });
+
+console.log(`Shipped and verified public deploy with PUBLIC_QA_VERSION=${qaVersion}`);
+
+function makeQaVersion() {
+  const stamp = new Date().toISOString().replace(/[-:.TZ]/g, '').slice(0, 14);
+  return `ship-${stamp}`;
+}
+
+function runPnpmScript(scriptName, extraEnv = {}) {
+  const label = `pnpm run ${scriptName}`;
+  console.log(`\n$ ${label}`);
+
+  const result =
+    process.platform === 'win32'
+      ? spawnSync(process.env.ComSpec ?? 'cmd.exe', ['/d', '/s', '/c', `pnpm.cmd run ${scriptName}`], {
+          cwd: process.cwd(),
+          env: { ...process.env, ...extraEnv },
+          stdio: 'inherit'
+        })
+      : spawnSync('pnpm', ['run', scriptName], {
+          cwd: process.cwd(),
+          env: { ...process.env, ...extraEnv },
+          stdio: 'inherit'
+        });
+
+  if (result.status !== 0) {
+    throw new Error(`Command failed: ${label}`);
+  }
+}