Add safe one-time npm first-publication workflow

[DelshadH]

Summary

• publish the genuine reviewed 0.1.0-alpha.1 packages once from protected GitHub-hosted CI
• verify exact artifacts, registry absence, provenance, and non-rerunnable incident handling
• revoke the one-time token on every authenticated exit path and prohibit placeholders

Verification

• clean token-free run: 154 tests, package smoke, examples, demo + recording, real upgrades, corpus, performance, security, release preparation
• actionlint v1.7.12
• immutable tarball SHA-256 verification and four registry E404 checks

No tag, GitHub release, npm token, or registry publication is created by this PR.

[DelshadH]

Exact-head token-free evidence for \

[DelshadH]

Independent exact-SHA release review: PASS for \