feat(npm): add publish parse + envelope validate + pre-check (S11 Step 14, part 2/3)

📦 Stacked MRs

This change is split into 3 stacked merge requests to keep each part within the team's review size limits (~600 LoC ideal). Each part targets the previous one (part 1 targets main). Please review and merge them in order, bottom-up — merging part 1 auto-retargets the rest.

Stack (review/merge bottom-up)

• feat(npm): add publish-flow error codes and mes... (!642 - merged) • David Fernandez • 19.2
• feat(npm): add publish parse + envelope validat... (!643 - merged) • David Fernandez • 19.2 👈
• test(npm): add publish parse/precheck integrati... (!644 - merged) • David Fernandez • 19.2

📌 This part

Part 2 of 3 of npm hosted — Step 14: publish handler parse, envelope validate, pre-check.

Implements S11 Publish flow Step 1 (parse and validate the envelope via the merged streampub library) and Step 2 (quota and version-exists pre-check):

• ServeHTTP drives streampub.Process over the publish request, then runs the pre-check; it stages no tarball on any failure path, and a fully admitted publish returns 501 (stream/CAS is Step 15, commit is Step 16).
• processEnvelope maps every code streampub.Process can emit to its spec status — bad_request/publish_envelope_invalid → 400, all others → 422 — with a fail-closed default.
• The pre-check returns 409/413/422/429 in the spec's Step 2 order (version-exists → quota → version-count → tag-count).

Includes the white-box TestProcessEnvelope_Mapping table that pins the full code→status mapping. Depends on the error codes in part 1. The end-to-end integration suite is part 3.

🔗 References

• Plan: docs/plans/2026-05-11-npm-hosted.md — Step 14
• Spec: docs/specs/S11-npm-hosted.md

Related to #132 (closed)