Fix existing npm version verification

[JasonSmall]

Summary

Fix the Open Receipt v0.2.1 release safeguard after npm 12 returned dist.integrity as a nested dist.integrity property instead of the flat key emitted by older npm clients.

• accept both npm metadata shapes while still requiring the exact package name, version, and integrity
• add a manual verification trigger that checks out an existing release tag
• keep the npm publish step conditional on the exact version being absent

Validation

• reproduced the npm 12 metadata-shape failure from release run 30750224091
• validated the nested and flat metadata parser paths locally
• bun run check — 57 tests passed; typecheck and build passed
• the failed release run skipped the npm publish step; no npm publication was attempted