v1.0.1-beta.2

fix(npm): publish with a single dist-tag, no follow-up dist-tag add

npm's OIDC Trusted Publishing only authenticates the `npm publish`
command itself — it does not extend to other authenticated registry
writes run afterward in the same job. Confirmed against a real CI
failure: `npm publish --provenance --tag beta` succeeded via OIDC, the
follow-up `npm dist-tag add ... latest` immediately failed with a 401.

Folds the "should this land on latest" decision into the one publish
call instead: beta versions publish straight to `--tag latest` until a
real stable version has ever shipped for that package, then switch to
`--tag beta` only, matching the prior policy's intent without a second
authenticated call.

Verified via `npm publish --dry-run` against the real registry,
including against the live partially-published 1.0.1-beta.1 state left
by the failed run (darwin-x64 correctly skipped via the idempotency
check; the remaining packages publish with the new single-tag logic).

ISSUE-88

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>