release: enforce staged npm publication

[0thernet]

Summary

• replace direct dual-use npm publishing with stage-only trusted publishing
• bind staging and release to exact current owner-authorized workflow attempts
• fail closed on unsafe stable-version bounds and release ordering
• verify package identity, signatures, provenance, latest, and immutable release ordering
• retain one deliberate human 2FA promotion per stable train

Validation

• focused workflow and attestation tests: 33 passed
• bun run check:workflows
• bun run typecheck
• workflow shell syntax parse
• git diff --check
• repository aggregate check is running through hra-host-run; merge remains gated on it and CI