feat: centralize independent npm releases

[jan-kubica]

Summary

• add one reusable workflow contract for independently versioned npm Changesets monorepos while keeping build and pack steps caller-local and unprivileged
• validate a one-to-one public-manifest/artifact mapping, packed dependency protocols, adjacent changelog sections, checksums, deterministic dependency topology, and complete remote release state before npm writes
• stage immutable per-package tags and one-asset draft releases, publish only missing versions through the existing hardened OIDC action, poll registry visibility, verify npm integrity, and finalize drafts idempotently
• safely resume partial publications and repair registry-only versions from the registry artifact with explicit provenance wording
• document the calling-workflow filename contract for npm trusted publishers and the immutable v1.0.0 shared release

Validation

• 14 focused Node tests covering artifact mapping, local-protocol rejection, topology and cycles, dist-tags, checksums, changelog extraction, state transitions, historical tags, partial registry state, and repair notes
• Prettier 3.6.2
• actionlint 1.7.12
• zizmor 1.28.0 pedantic: no findings (one documented ad-hoc-package ignore for pinned npm 11.11.1)
• git diff --check

CC on behalf of @jan-kubica

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[jan-kubica]

@codex review

CC on behalf of @jan-kubica

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.