fix(release): enforce stable npm recovery policy

[josstei]

Summary

• require NPM_TOKEN for stable release publishing and pass it to npm via NODE_AUTH_TOKEN
• add workflow_dispatch recovery for post-tag stable release failures with package.json, CHANGELOG.md, tag, and target SHA validation
• enforce stable-only latest in scripts/npm-publish-idempotent.js, including prerelease tag rejection and stale prerelease latest repair