build: harden release inputs and isolate test bundles

[PathGao]

Summary

• Use npm ci in release builds so the resolved dependency graph matches the lockfile.
• Stop uploading portable Windows executables under installer-like names.
• Add an isolated macOS test-bundle builder requiring a non-production bundle identifier.
• Add workflow regression tests and update release documentation.

Scope

This is independent of the current Stack. It is related to the release hardening tracked in #334, but does not claim to resolve the pending Defender investigation.

Validation

• npm ci
• npm run check
• npm test (152 passing)

[PathGao]

@alecdotdev This PR also removes the release-workflow behavior that uploaded the portable executable a second time under the misleading MarkpadInstaller_* name. The actual NSIS installer remains the *-setup.exe artifact.

For #334: I saw that the issue was closed after identifying the custom uninstall script as the likely Defender trigger, but I cannot find a corresponding code change. Do you want to rework that uninstall path before the next Windows release, or was the issue closed because the release was removed and no further change is planned?