fix(release): retry npm publication without moving tags

[JimmyDaddy]

Why

The 0.5.0 release stopped before npm upload because npm 12 rejects the SDK cross-version fixture's direct tarball URL. The existing v0.5.0 tag and GitHub Release must remain unchanged.

Changes

• Fetch the exact published 0.4.0 package through the official npm registry from an empty temporary directory, retaining the pinned SHA-512 SRI and package-contract assertions.
• Add a main-only manual retry to the existing trusted-publisher workflow for an already published GitHub Release. Pin checkout to the exact tag commit, require main ancestry, and only accept an explicit npm E404 before publication.
• Use the workflow commit's unpackaged SDK test harness during the full release gates, restore the tag's script, and verify a clean tracked tree before publishing. Keep OIDC, provenance verification, and post-publication SDK smoke tests.
• Document recovery without retagging, recreating releases, or republishing an existing npm version.

Validation

• Complete SDK consumer suite with Node 24.19.0 / npm 12.0.1, including strict TypeScript, Vite/Chrome Worker execution, and registry 0.4.0/native cross-version checks.
• Typecheck, lint, and all 11 Jest tests.
• Actionlint and Prettier for the changed workflow and consumer script.
• 15 executable request/identity cases covering wrong refs/tags, draft or missing publication metadata, already published versions, and registry failures.
• Repacked 0.5.0 has identical contents (73 files) and SHA-256 to the approved candidate: b22f85b3591321d6b86c3c9b64c35a8370d6049391bb5190dee2cff9a402bdd2.
• Independent workflow review: no remaining P1/P2 findings.

@wip ready for review