Use staged npm publishing for language releases

[konojunya]

背景

Language package releases should use the same human-approved npm supply-chain boundary as the engine package. The first release remains a one-time authenticated bootstrap because npm requires an existing package before Trusted Publisher configuration.

実装方法

• pin npm 11.15.0 and replace direct publishing with npm stage publish
• add the first-release bootstrap and subsequent stage, inspect, 2FA approve, and verify flow
• retain exact language-v<version> tag, ancestry, tests, types, package audit, registry, and provenance gates

テスト方法

• npm ci
• npm run test:language
• npm run typecheck:language
• npm run pack:check
• all existing schema and conformance validation commands
• npm audit --audit-level=high
• parse all workflow YAML files

Review 視点 / 懸念点

• The future Trusted Publisher must allow npm stage publish for workflow release-language.yaml.
• The initial 0.1.0 package is published manually before this trust relationship can be configured.