ci: publish and reuse packed release artifact

[rogerchappel]

Summary

• pack the npm package exactly once in each release workflow and expose its filename as a step output
• publish that exact tarball to npm with public access and provenance, then attach it to the GitHub release
• dry-run publication of the same packed artifact on release-related pull requests
• add an executable workflow regression guard and document npm trusted-publisher setup

Commits:

• test: guard packed release artifact reuse
• ci: publish and reuse packed release artifact
• docs: describe verified npm release flow
• chore: declare npm release publication

Files changed: .github/workflows/release.yml, .github/workflows/release-dry-run.yml, scripts/check-release-workflows.mjs, package.json, releasebox.config.json, README.md, docs/release-readiness.md, and CHANGELOG.md.

Verification

• Tests or checks run:
  • npm ci
  • npm run release:check (15 tests passed; build, typecheck, smoke, package smoke, and workflow regression check passed)
  • bash scripts/validate.sh
  • ruby -e 'require "yaml"; ARGV.each { |path| YAML.parse_file(path) }' .github/workflows/release.yml .github/workflows/release-dry-run.yml
  • git diff --check
• Manual review completed: verified the workflow regression check fails on the pre-change workflows and that every proposed commit has the required author and committer identity.

Risk Level

• Low
• Medium
• High

Notes: This changes tag-triggered publication. Before creating the first version tag, npm must configure rogerchappel/scriptaudit and .github/workflows/release.yml as the trusted publisher. This PR does not trigger a release.

Rollback Plan

• Revert the four commits to restore the previous GitHub-release-only workflow.

Human Decision Needed

• None
• Maintainer review
• Product/design decision
• Security/privacy review
• Other: