[codex] finish stdnum release prep

[jan-kubica]

What changed

• replaces the tag-push release with a controlled workflow_dispatch release flow
• adds a release verification job that re-runs lint, test, typecheck, build, export sync, oracle gate, and dry-run packaging from the tagged revision
• packs release artifacts into a GitHub release with checksums before any npm publish step
• makes npm publish opt-in per run and resilient to already-published / first-publish race conditions
• adds a CI Pack job so packlist issues show up before release day

Why

stdnum is already technically strong, but the release path was still behind the bar set by the search repos. It was tag-push driven, had no clean non-publishing dry-run mode, and did not exercise packaging in CI.

This keeps the repo private and unpublished by default while making the eventual first public release much more controlled.

Impact

• release day becomes a manual, auditable operation instead of a tag side effect
• we can run a full tagged verification pass without publishing
• package tarball shape is checked continuously in CI
• first npm publish is more robust when we are ready to do it

Validation

• bun install --frozen-lockfile
• bun run lint
• bun run typecheck
• bun run build
• bun test
• ORACLE_SAMPLES=500 bun run oracle
• npm pack --json --ignore-scripts --dry-run

---