Release workflow does not gate on tests

The release workflow (`release.yml`) publishes to npm and PyPI without running tests first. A failing test (e.g., bin entry mismatch) will not prevent a broken release from being published.

Additionally, there are no automated guards to catch build.ts branding regressions (binary name, user-agent, engine version embedding) that upstream merges can introduce.