fix(ci): serialize npm publish test run

Author: Jacobinwwey

.github/workflows/npm-publish.yml

@@ -130,7 +130,9 @@ jobs:
         run: npm run verify:sidecar:signatures -- --contract-only
 
       - name: Run tests
-        run: npm test
+        # Release CI is intentionally serialized here because the parallel Jest
+        # worker pool can trigger broken stdout pipes in spawned Node CLIs.
+        run: npx jest --runInBand
 
       - name: Publish to npm
         run: npm publish

src/sbom.attestation.policy.contract.test.ts

@@ -129,6 +129,7 @@ describe('sbom attestation policy contract', () => {
     expect(npmPublishWorkflow).toContain('NOTE_CONNECTION_SBOM_ATTESTATION_VERIFY_TRANSPARENCY_LOG_INCLUSION');
     expect(npmPublishWorkflow).toContain('NOTE_CONNECTION_SBOM_ATTESTATION_TRANSPARENCY_EXPECT_SCHEMA');
     expect(npmPublishWorkflow).toContain('NOTE_CONNECTION_SBOM_ATTESTATION_TRANSPARENCY_EXPECT_VERSION');
+    expect(npmPublishWorkflow).toContain('npx jest --runInBand');
   });
 
   test('attestation generator and verifier work in unsigned strict policy mode', () => {