[codex] Harden release publishing

[stackbilt-admin]

Summary

Hardens the Charter release path so workspace protocol dependencies cannot leak into published npm tarballs.

Changes

• Add a root publish:check script that packs each publishable package and inspects the packed package.json for workspace: dependency specifiers.
• Add prepublishOnly guards for packages with workspace deps so direct npm publishes fail before source manifests can leak.
• Update the npm release workflow to validate tag format, run packed-manifest verification, pack with pnpm, and publish the generated tarballs with npm provenance.
• Document the synchronized package-version invariant and release validation steps in PUBLISHING.md.

Issues

Addresses #122
Addresses #123
Addresses #131

Verification

• pnpm run publish:check
• npm run prepublishOnly in packages/cli fails with the intended direct-npm guard
• pnpm run prepublishOnly in packages/cli passes
• Local release packing exercise produced all 11 expected tarballs

[stackbilt-admin]

Superseded by #141 (consolidated branch: codex/consolidate-pre-repo-work). Closing this PR in favor of the combined review.