Fix npm release verification

[konojunya]

背景

The v0.1.0 release workflow rebuilt and tested the browser package successfully, but its package-content audit failed before the registry check. npm 12 changed npm pack --json --workspace from an array to an object keyed by workspace name, while the validator only accepted the npm 11 shape.

実装方法

• Normalize both npm 11 array output and npm 12 workspace-object output before auditing package contents.
• Pin the release environment to npm 11.5.1, the minimum CLI version required for npm trusted publishing.
• Add a manual recovery input that checks out an existing exact release tag and applies the same version, ancestry, build, test, package, and publication gates without moving the tag.
• Document the recovery path.

テスト方法

• npm run pack:check with npm 11.5.1
• npm run pack:check with npm 12.0.2
• npm test
• npm run typecheck
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/release.yaml
• Run the package audit in the Node 24.18/npm 12 Linux release environment

Review 視点 / 懸念点

The existing public v0.1.0 tag remains unchanged. After this pull request is merged, the manual recovery path will re-run the release checks against that exact tag; because @stack-sh/engine@0.1.0 already exists, it must not publish a duplicate version.