fix(release): serialize trusted publication

[0thernet]

Summary

• separate reviewed artifact creation from the sole source-free OIDC staging mutation
• revalidate current main, npm latest, the absent candidate tag, and the prior annotated tag plus immutable GitHub Release at the terminal publication boundary
• constrain workflow execution with exact step, permission, environment, provider-mutation, and whole-workflow semantic validation
• expand adversarial and behavioral coverage for drift, fail-open controls, command wrappers, and release-closure races

Validation

• focused release workflow suite: 42 tests, 904 assertions
• workflow validator suite after final semantic seal: 12 tests, 161 assertions
• TypeScript typecheck
• independent adversarial review: no P0/P1 findings
• full standalone check queued through the repository scheduler; merge will wait for it and required GitHub checks

No package version, npm stage, npm publication, tag, GitHub Release, or provider state is changed by this PR.