Fix version bump flow for protected main

[Banegasn]

Summary

• Split protected-branch version preparation from package publishing. The new Prepare Package Versions workflow creates a branch for a PR; Publish Packages no longer tries to push a version commit to main.
• Replace the old bump command with a script that updates public package versions, exact workspace references, and the pnpm lockfile together. Private packages are excluded.
• Add an npm-only publication option for releases where older GitHub packages do not grant this repository write access, and update the publishing guide.

Why

The failed patch run bumped package manifests, then GitHub rejected its direct push to protected main because the new commit had no required quality check. Its old bump command would also leave exact Angular workspace references and the lockfile stale.

Verification

• Single-package patch bump in an isolated checkout updated only the rail manifest, Angular reference, and lockfile; frozen install passed.
• All-public-package patch bump in an isolated checkout updated 26 public packages, Angular references, and lockfile; frozen install and pnpm build passed.
• node --check, workflow YAML parsing, and git diff --check passed.