fix: count prereleases on registries without a latest dist-tag

[theoephraim]

Fixes #163.

npm info <name> versions --json resolves through the tag config (latest). When the package has no latest dist-tag — e.g. GCP Artifact Registry, which only sets the tag you publish with — npm prints nothing and exits 0, so bumpy parsed "", fell back to [], and restarted every channel counter at .0.

• fetchPublishedVersions tries the default lookup, then falls back to --tag <channel tag>. If neither resolves, it reports unresolved and buildChannelReleasePlan adds a warning instead of silently counting from 0.
• Snapshot idempotency now checks npm info <name>@<version> directly (no dist-tag resolution).
• packageExistsOnNpm (OIDC new-package check) treats exit 0 as "exists", since output is empty without latest.
• Tests cover the fallback, unresolved warning, registry passthrough, and exact-version check via the shell mock.

🤖 Generated with Claude Code

[github-actions]

The changes in this PR will be included in the next version bump.

Patch releases

• @varlock/bumpy 1.18.1 → 1.18.2

Bump files in this PR

• prerelease-counter-no-latest-tag.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.

[pullfrog]

Important

Registry command failures still bypass the new unresolved-state warning and can silently restart a published channel at .0.

Reviewed changes in 293845b, covering the registry fallback, channel planning, snapshot idempotency, package-existence check, and regression tests.

• Channel version discovery — retries an empty latest lookup through the configured channel dist-tag and propagates unresolved state into release planning.
• Collision visibility — emits a warning when neither latest nor the channel tag exposes the package version list.
• Exact snapshot lookup — checks the generated snapshot version directly instead of relying on package-wide dist-tag resolution.
• OIDC package detection — treats successful package metadata lookup as package existence even when output is empty.
• Regression coverage — exercises fallback lookup, custom registry forwarding, warning behavior, and exact-version checks.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review in 293845b; the new commit addresses the outstanding registry-failure classification concern without regressing the dist-tag fallback.

• Failure classification — Distinguished confirmed E404 responses from authentication, network, registry, and malformed-response failures.
• Warning propagation — Preserved first-publication behavior for missing packages while surfacing operational lookup failures before selecting prerelease counter .0.
• Regression coverage — Added tests for non-404 command failures, malformed responses, fallback failures, and the resulting release-plan warning.

  ^{｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}