Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/publish-npm.yml:
- Around line 15-18: Move the top-level id-token: write permission into the
publish job's permissions block so only the publish job can request OIDC tokens;
specifically remove or change the top-level "id-token: write" under permissions:
and add "permissions: contents: read id-token: write" (or just "id-token:
write") inside the publish job definition that runs the npm publish --provenance
step, leaving other jobs (e.g., validate) without id-token privileges to adhere
to least-privilege.
- Around line 65-71: The run script in the "Extract version from tag" step
currently injects `${{ github.ref_name }}` directly into shell which is unsafe;
change the step to pass the tag into the shell via an env variable (e.g., env:
REF_NAME: ${{ github.ref_name }}) and then perform safe expansion inside the
script using that env variable (e.g., VERSION="${REF_NAME#v}") before writing to
GITHUB_OUTPUT and GITHUB_STEP_SUMMARY; update the step with id "version" to use
the env variable rather than direct interpolation.
- Around line 27-30: Replace the moving tags for external GitHub Actions with
their immutable commit SHAs: find usages of actions/checkout@v6 and
actions/setup-node@v6 (and the other two occurrences referenced) in the
publish-npm.yml workflow and change each uses: entry to uses:
actions/checkout@<COMMIT_SHA> and uses: actions/setup-node@<COMMIT_SHA>
(substitute the correct commit SHA from the action's repository release/commit)
so the workflow pins to exact commits instead of the floating v6 tags.
- Around line 37-41: The step currently pipes `npm pack --dry-run` into `tee
pack-output.txt`, which masks `npm`'s exit code; update the run block so the
step fails when `npm pack --dry-run` fails by either enabling bash pipefail (add
`set -o pipefail` at the start of the run) or capture and propagate the upstream
exit status (e.g., run `npm pack --dry-run 2>&1 | tee pack-output.txt;
rc=${PIPESTATUS[0]}; echo "### npm pack --dry-run" >> $GITHUB_STEP_SUMMARY; cat
pack-output.txt >> $GITHUB_STEP_SUMMARY; exit $rc`), ensuring `npm pack
--dry-run`, `tee pack-output.txt`, and the writes to `GITHUB_STEP_SUMMARY`
remain unchanged except for the added exit handling.
- Around line 43-46: The current verification step ignores failures because it
runs "node bin/govon.js --check-install || true" and then always echoes success;
remove the "|| true" and split syntax validation from environment checks so
failures propagate: run "node bin/govon.js --check-install" (no "|| true") to
fail the job on real errors, and if you want a separate quick syntax test keep a
distinct command (e.g., a plain "node -c" or a dedicated "node bin/govon.js
--syntax-check") before or after, ensuring the echo message only runs when the
preceding command succeeds; update the step that references "node bin/govon.js
--check-install" and the trailing "echo" accordingly.

In `@packages/npm/bin/govon.js`:
- Around line 21-24: The current spawn('govon', args, ...) risks recursively
invoking the wrapper from PATH; instead use the Python executable detected by
python-check.js (checkEnvironment() -> pythonCmd) and spawn pythonCmd with
arguments ['-m', 'govon', ...args] so the real Python runs the govon module;
update the spawn call in govon.js (where child is created using spawn and args)
to use pythonCmd and the '-m', 'govon' prefix while preserving stdio: 'inherit'
and shell: false.
- Around line 42-44: The callback for child.on('close') must accept both (code,
signal) and not treat a signal termination as a successful exit; update the
child.on('close', ...) handler to accept the second parameter signal and call
process.exit with a non-zero code when signal is present (for example use code
if defined, otherwise 1 when signal is truthy, else 0), and optionally include
the signal name in a log before exiting so callers/CI can detect signal-term
failures; change the existing handler around child.on('close', ...) and
process.exit(...) accordingly.

In `@packages/npm/README.md`:
- Around line 19-24: README에 있는 설치 명령 `pip install govon`은 다중 Python 환경에서 잘못된
인터프리터에 설치될 수 있으므로, 문서를 수정하여 현재 사용 중인 인터프리터와 같은 pip를 사용하도록 안내하세요: 기존의 `pip
install govon`을 `python -m pip install govon`으로 교체(또는 더 명확히 하려면 `python3 -m pip
install govon`)하여 래퍼가 검사한 인터프리터와 동일한 환경에 패키지가 설치되도록 만드세요.