fix(release): make publish path recoverable and its verification real

[martin-fleck-at]

• Stop --dry-run writing the stamped version to disk: only the publish honoured the flag, so a dry run desynchronised every manifest from the lockfile and the next install asked the registry for a version that had never been published
• Skip a package whose dist-tag already points at the version, so a PARTIAL publish can be re-run: the packages that succeeded otherwise reject the retry, and the version cannot be advanced without a commit because it is derived from the commit count rather than stored
• Verify against the dist-tag endpoint rather than the package document, with backoff; npm view reads a CDN that caches NEGATIVE responses, and the bootstrap queries every name while it does not exist, so the check failed on precisely the first publish it exists to guard
• Read dist-tag output as TEXT: the subcommand accepts --json and ignores it, so JSON.parse threw and every caller failed open
• Keep stdio fully inherited; capturing stderr to read npm's rejection prevents the interactive one-time-password prompt

Verified against the live registry with all ten versions already published: ten skips, then the verification passed.

Fixes #7