ci: fix public registry release flow

[longlho]

Summary

• publish npm packages as unscoped public packages
• make release-please use RELEASE_TOKEN and branch-aware testing
• fix Cargo.lock release-please JSONPaths
• publish npm packages from a Bazel-built release workspace with pnpm so workspace:* dependencies are rewritten
• fix npm smoke linking for unscoped package names

Validation

• YAML parsed with Ruby YAML.load_file
• pnpm install --frozen-lockfile --ignore-scripts passed locally
• pnpm --filter codescythe pack produced a tarball whose optionalDependencies were rewritten from workspace:* to 0.4.12
• Previous e2e npm workflow run 26431527340 passed build and platform smoke tests, but used npm publish and leaked workspace:*; this PR replaces that publish path with the FormatJS-style pnpm release workspace
• Codescythe Crates Release run 26430657328 passed verify and publish
• crates.io API returned codescythe 0.4.13-e2e.20260526 with trusted publishing metadata