ci: verify npm publication before release cleanup

[ByBrawe]

Summary

• make one-shot release/npm-v* branches the only npm publish trigger
• remove the redundant v* tag trigger that could re-run the same publish workflow after the release branch creates its tag
• poll the public npm registry for the exact published package version after npm publish
• create the GitHub tag/release and delete the one-shot release branch only after registry verification succeeds

Why

The release branch already owns the full publication transaction: verify, test, pack, npm publish, tag, GitHub release, and branch cleanup. Listening to the generated v* tag as a second publish trigger can create a redundant follow-up run whose existing-tag guard necessarily fails.

The workflow also previously trusted the npm publish process exit alone. Registry propagation is now checked explicitly with bounded npm view <package>@<version> version retries before the release is finalized.

Scope

Release CI only. Runtime/package source is unchanged.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.