fix(release): harden staged publish validation

[f0rr0]

Summary

• harden release artifact download/gating for pinned CI runs, including large job payloads and multi-artifact checksum manifest merges
• move release-please tag/release creation until after artifact download and selected product dry-runs pass
• validate staged WASIX runtime crates with materialized payloads, scoped package checks, and raw CI AOT target triples
• add registry-native dry-run coverage for staged JSR packages and post-publish registry verification for Node direct optional npm packages
• make direct release helper invocation executable-safe and clarify enforced crate-size failures

Validation

• tools/release/release.py check
• tools/policy/check-workflows.sh
• python3 -m py_compile tools/policy/check-release-policy.py tools/release/release.py tools/release/check_node_direct_release_assets.py
• bash -n tools/policy/check-crate-size.sh tools/policy/check-crate-package.sh .github/scripts/download-build-artifacts.sh .github/scripts/require-workflow-success.sh
• real artifact downloads from CI run 27851941356 for WASIX, broker, Node direct release assets, and Node direct optional npm packages
• staged product validators for Node direct, Rust, Swift, WASIX Rust binding, broker, React Native, and TypeScript/JSR

Remaining Release Blocker

liboliphaunt-wasix still cannot publish to crates.io as currently packaged: the materialized internal payload crates are 36-57 MiB, while crates.io has a 10 MiB .crate limit. This PR keeps that failure explicit instead of bypassing it.