## Problem

A push to public `master` started testing and publishing as independent
workflows. v4.23.1 was therefore published while Windows CI was still
running, and the release completed before that job reported a failure. A
broken release candidate could reach npm before either platform
established that it was safe.

The Windows failure itself came from test teardown, not the published
runtime: the lazy-cache test started background removal of a legacy
cache directory, then its fixture disposer tried to remove the same
directory. Windows rejected the overlapping deletion with `EPERM`.

## Changes

Publishing now calls the same reusable Ubuntu/Windows test matrix used
by pull requests and waits for every job to pass. The release job
receives write and OIDC permissions only after that gate succeeds, while
tests remain read-only and do not persist checkout credentials.

The lazy-cache coverage now tests deferred access without starting
cleanup, then verifies first-use initialization separately with no
legacy directory to delete. This preserves both contracts without racing
fixture disposal.

fix: upgrade cross-spawn to 7.0.6

Co-authored-by: Hiroki Osame <hiroki.osame@gmail.com>

When a signal is received after the watched script has already exited,
watch mode exited with the raw signal number (2 for SIGINT), which
PowerShell & VS Code on Windows surface as an error. Use the standard
128 + signal convention, consistent with the non-watch CLI.

* fix: preserve listenerCount overload semantics

* test: cover hidden signal relay aggregate count

---------

Co-authored-by: Hiroki Osame <hiroki.osame@gmail.com>

* Fix

* Single line comment

* Send signal unconditionally on Windows

---------

Co-authored-by: Hiroki Osame <hiroki.osame@gmail.com>