fix(release): restore npm publishing with a verified npm version

[moonyue-w]

Summary

Fix the 0.2.0 release failing in npm publish with Cannot find module 'sigstore'. Pin npm 12.0.2 consistently across preflight, publishing, and registry verification, and dry-run the publishing command on the packed artifact during preflight before creating a release tag.

Document how to resume a tagged release after a workflow-only fix and clarify the SHA input description. Package source, package version, existing tags, and release notes are unchanged.

Why

The npm 12.0.0 distribution omitted the sigstore dependency required by libnpmpublish. The upstream correction shipped in npm 12.0.1: npm/cli#9740.

Failed release: https://github.com/QoderAI/qoder-cloud-agents-sdk-ts/actions/runs/35983109046.

Verification

• Downloaded the official npm 12.0.0 and 12.0.2 tarballs and verified their registry integrity hashes.
• With the exact qca-sdk-0.2.0.tgz artifact from the failed run, npm 12.0.0 reproduces the missing-sigstore failure; npm 12.0.2 succeeds with publish --dry-run --ignore-scripts --provenance --access public --tag latest using empty credentials/configuration. No package was uploaded.
• actionlint 1.7.12 validates the release workflow (external shellcheck/pyflakes integrations disabled).
• Changelog validation and all 19 release-notes automation tests passed.
• git diff --check passed.
• SDK builds/tests, examples, and live integration were not rerun locally for this workflow/documentation-only change; regular PR CI provides the existing build, test, type, and documentation checks.

The dry-run validates CLI loading and package handling. OIDC authorization, provenance generation, and registry upload still require the approved release job.

Impact and release recovery

• No SDK API, behavior, package version, contract fixture, or generated API documentation changes.
• No user-facing changelog entry is needed for this release-infrastructure fix.
• Go/Python release workflows do not use this npm installation.
• No credentials, environment files, downloaded packages, logs, or generated test output committed.

After merging, start a new release.yml run from main with the same original inputs:

version: 0.2.0
commit_sha: 3bb65a7b13871fb0ae1a4a5d8c63d3b6143a02a1
batch_id: sdk-0.2.0-20260924

The annotated v0.2.0 tag already points to that SHA, while npm has no 0.2.0 package yet. The workflow already supports resuming this tagged commit after main advances. Keep the tag unchanged. Re-running the old failed run would retain its old workflow revision and npm pin.