release: adopt npm staged publishing #296

npm's trusted-publisher settings now offer npm stage publish as the always-allowed action and mark "Allow npm publish" (direct publish) as not recommended. Our publish.yml publishes directly under OIDC with that box checked on all seven packages.

Correction to the original framing: npm's January 2027 change removes direct publishing with 2FA-bypass granular access tokens. OIDC trusted publishing is not affected, and this repository stores no token, so nothing is forced by that date. The reason to move is security posture: staged publishing puts a human 2FA promote step between CI and the registry, and it is what npm recommends. If any package's trusted publisher is ever switched to stage-only, npm publish is rejected outright and the workflow fails until the script speaks npm stage publish.

Proposal: switch bin/publish-tagged.ts to npm stage publish in CI, so a release lands in npm's staging area, and a maintainer promotes it under 2FA in the npm UI. Then uncheck "Allow npm publish" on each package.

Needs: confirming the CLI semantics of npm stage publish on npm 11, whether a staged version is visible to npm view <name> versions (the script's idempotency probe), and what promotion looks like for seven packages at once.

Context: the release process landed in #293, was fixed in #295, and is documented in RELEASING.md (#298).