diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f10c662..6253078 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -146,7 +146,7 @@ jobs:
       - name: Aggregate double-mount regression
         env:
           DSH_CMD: dsh
-        run: bash scripts/e2e-aggregate-mount.sh
+        run: pnpm test:mount:aggregate
 
       - name: Upload Playwright report on failure
         if: failure()
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index de47be6..32b625e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -84,15 +84,21 @@ jobs:
             exit 1
           fi
 
-      - name: Build
-        run: pnpm build
-
       - name: Typecheck
         run: pnpm typecheck
 
       - name: Test
         run: pnpm test
 
+      - name: Build
+        run: pnpm build
+
+      # The consumer-facing declaration surface guard — mirrors the ci.yml
+      # verification order (typecheck → test → build → check:consumer-types)
+      # so a release is gated on the same checks a PR runs.
+      - name: Check consumer type surface
+        run: pnpm check:consumer-types
+
       - name: Dry-run publish (validation only)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true'
         run: pnpm publish --dry-run --no-git-checks
diff --git a/package.json b/package.json
index 28d9aaf..53f674e 100644
--- a/package.json
+++ b/package.json
@@ -39,6 +39,7 @@
   "engines": {
     "node": ">=20"
   },
+  "packageManager": "pnpm@11.8.0",
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -79,6 +80,8 @@
     "prepare": "tsdown",
     "test": "vitest run",
     "test:mount": "bash scripts/e2e-mount.sh",
+    "test:mount:aggregate": "bash scripts/e2e-aggregate-mount.sh",
+    "clean": "node -e \"require('node:fs').rmSync('lib',{recursive:true,force:true})\"",
     "check:consumer-types": "bash scripts/check-consumer-types.sh"
   },
   "license": "MIT",