docs: note npm release pitfalls

docs/RELEASING.md

@@ -42,6 +42,15 @@ Use `pnpm` (Node 22+) from the repo root. Keep the working tree clean before tag
 - [ ] `npm publish --access public` (use `--tag beta` for pre-releases).
 - [ ] Verify the registry: `npm view clawdis version` and `npx -y clawdis@X.Y.Z --version` (or `--help`).
 
+### Troubleshooting (notes from 2.0.0-beta2 release)
+- **npm pack/publish hangs or produces huge tarball**: the macOS app bundle in `dist/Clawdis.app` (and release zips) get swept into the package. Fix by whitelisting publish contents via `package.json` `files` (include dist subdirs, docs, skills; exclude app bundles). Confirm with `npm pack --dry-run` that `dist/Clawdis.app` is not listed.
+- **npm auth web loop for dist-tags**: use legacy auth to get an OTP prompt:
+  - `NPM_CONFIG_AUTH_TYPE=legacy npm dist-tag add clawdis@X.Y.Z latest`
+- **`npx` verification fails with `ECOMPROMISED: Lock compromised`**: retry with a fresh cache:
+  - `NPM_CONFIG_CACHE=/tmp/npm-cache-$(date +%s) npx -y clawdis@X.Y.Z --version`
+- **Tag needs repointing after a late fix**: force-update and push the tag, then ensure the GitHub release assets still match:
+  - `git tag -f vX.Y.Z && git push -f origin vX.Y.Z`
+
 7) **GitHub release + appcast**
 - [ ] Tag and push: `git tag vX.Y.Z && git push origin vX.Y.Z` (or `git push --tags`).
 - [ ] Create/refresh the GitHub release for `vX.Y.Z` with **title `clawdis X.Y.Z`** (not just the tag); body should inline the product-facing bullets from the changelog (no bare links) **and must not repeat the title inside the body**.