Add guarded initial theme publication

[konojunya]

Summary

• Bootstrap stack-theme 0.5.0 from an exact successful main commit.
• Require package identity, registry absence and credential-free package verification before exposing the short-lived publish token.
• Document post-publication cleanup and the trusted-publishing handoff.

Verification

• Four publication guard tests and actionlint pass.
• Catalog validation, generated artifact equality, 23 JavaScript tests and type checking pass.
• Stable / Rust 1.85 tests, Clippy, rustdoc and Rust 1.85 publication dry run pass.