Publication reachability is a judgement call; check the npm package contents in CI #459

In #455 I proposed deleting packages/sherpa-onnx.rn/ios/bridge/SherpaOnnxLegacySpec.h because nothing in the repository referenced it. That was the wrong test.

package.json lists ios in files, and the podspec globs ios/bridge/*.h with no private_header_files declaration — so CocoaPods exposes it as a public header and npm ships it. npm pack --dry-run showed it in the tarball on main and absent on my branch. Deleting it removes a published API from a 1.3.1 package.

Nothing would have caught that. The reviewer did, by running npm pack.

Suggested

Check in a normalized manifest of the published file list per package, and have CI regenerate and diff it:

npm pack --dry-run --ignore-scripts --json | jq -r '.[0].files[].path' | sort

Then a change to what ships becomes a reviewable diff rather than something a contributor has to think to check. Deleting a published header, or adding a file to a package unintentionally, both surface the same way.

Scope

sherpa-onnx.rn publishes whole android and ios trees, so it has the most surface. audio-studio and audio-ui are worth including for the same reason.

Related: #453 added the first CI workflow, so there is somewhere to put this now. #449 tracks the remaining harness gaps.