ci: publish verified releases to npm

[rogerchappel]

Summary

• validate release tags exactly against package.json, with missing/malformed/mismatched regressions
• validate before publication, publish to npm with provenance/public access, and create the GitHub release only after npm succeeds
• exercise prospective tags in the dry run and install/invoke the packed CLI in a clean temporary consumer
• document the actual npm distribution path

Commits

• feat: validate release tags — deterministic validator and release invariants
• ci: publish verified releases to npm — ordered tag validation, npm publication, and GitHub release creation
• test: exercise installed package CLI — clean consumer smoke and release documentation

Verification

• npm ci
• npm run release:check (27 tests; smoke and package smoke passed)
• npm run release:tag -- v0.1.0
• git diff --check

The workflow retains only contents: write and id-token: write; npm provenance uses GitHub OIDC and no new credential is introduced.