fix(release): publish the product users can run

[drewstone]

What changed

• Replace the broad credential-dependent publication blocker with direct installed-package use.
• Keep candidate and registry bytes identical across Linux x64, macOS arm64, and Windows x64.
• Send a real prompt, wait for its completed response, then quit cleanly.
• Publish through npm trusted publishing only; no reusable token fallback.

Direct use

Exact commit: e133d38
Candidate: @tangle-network/braid@0.1.1
SHA-256: 8a2af1371c9581f40a2a0844f206733c5a76ce7a877497a755b6b14cd9541d6d

The installed candidate completed the prompt platform package smoke, returned Fixture response through pi: platform package smoke, then exited cleanly after /quit. Encrypted storage and temporary-state cleanup also passed under Node 22 on Linux x64.

Checks

• pnpm check
• actionlint .github/workflows/release.yml
• pnpm release:prepare from a clean detached checkout
• scripts/release/smoke-package.mjs against the exact candidate
• independent security review; removed the persistent npm token fallback