Use staged npm publishing for releases

[konojunya]

背景

Direct Trusted Publisher releases remove the final maintainer confirmation. npm now supports stage-only OIDC permissions so CI can validate and upload an immutable version without making it public immediately.

実装方法

• pin npm 11.15.0, the first CLI release supporting staged publishing
• replace npm publish with npm stage publish
• document npm inspection and two-factor approval as explicit release gates
• preserve exact-tag checkout, ancestry, build, test, type, package-content, registry, and provenance checks

テスト方法

• npm ci
• npm test
• npm run typecheck
• npm run pack:check
• npm audit --audit-level=high
• parse all workflow YAML files

Review 視点 / 懸念点

• The npm Trusted Publisher must allow npm stage publish, not direct npm publish.
• Once a version is staged, rerunning the release workflow should be avoided until the staged version is approved or rejected.