build(release): add maintainer-driven publishing flow

[yimingjfe]

Summary

• Replace the write-enabled GitHub Actions release workflow with a maintainer-driven local release flow.
• Keep Changesets for accumulating changes and preparing a dedicated Version PR.
• Publish the verified tarball locally, then create the matching annotated Tag and GitHub Release.
• Restrict pull request CI to read-only repository permissions and pin third-party Actions to commit SHAs.

Release workflow

Developers continue to add one or more Changesets with:

pnpm change

Maintainers prepare and publish releases with:

pnpm release:prepare
# Squash merge the generated Version PR
pnpm release

Safety

• Require a clean, current main and a release-only Version commit.
• Install frozen dependencies with lifecycle scripts disabled.
• Reject prereleases, environment npm tokens, existing npm versions, and conflicting Tags or Releases.
• Build, test, pack, install, and smoke-test the actual tarball before confirmation.
• Publish explicitly to npm latest, push only the annotated release Tag, and create release notes from the matching changelog section.
• Preserve partial-failure state and provide manual recovery guidance without force updates or destructive rollback.

Verification

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm exec biome check .
• pnpm build
• pnpm test — 8 project tests and 8 release-tool tests passed
• git diff --check
• Independent code review: no remaining Critical or Important findings

No npm package, Git Tag, or GitHub Release was created while validating this change.