Harden one-time npm bootstrap publication

[DelshadH]

Summary

• serialize the one-time bootstrap and independently recheck publish identity
• pin Node 24.18.0/npm 11.16.0, add finite postpublication retry and incident evidence
• create the GitHub prerelease only after verified npm publication and revocation
• add a manual token-free exact-main preflight artifact path

Validation

• 157 tests passed
• package smoke, examples, demo/recording, real-upgrade gates, corpus, performance, security passed
• actionlint passed for ci.yml and npm-bootstrap.yml
• clean release preparation preserved all four accepted tarball SHA-256 values
• token-free preflight confirmed all four npm names absent

No tag, GitHub release, npm token, or npm publication was created.

[DelshadH]

Independent AI release-plumbing review at exact head 156c94caa999dceccb6f2d20ab17e0f66264d4de: PASS; no P0/P1 findings remain.

The reviewer verified the absolute 300,000 ms registry/provenance deadline includes request time and leaves job headroom, and that any attempted npm publish forces rerunAllowed: false, including transient-registry and token-revocation cases. This is AI review, not human approval, and grants no publication authority.