Harden npm release preflight

[jrkropp]

Summary

• add a release preflight that checks npm publication state before Changesets publish runs
• fail early when trusted publishing is enabled without NPM_TOKEN and a package name does not yet exist on npm
• document the bootstrap rule for brand-new package names

Why

The 0.2.0 release partially published @jrkropp/codex-js before npm rejected the new @jrkropp/codex-js-react package. npm trust configuration requires the package to already exist on the registry, so new package names need a token/manual bootstrap before OIDC-only releases are safe.

Validation

• pnpm format:check
• pnpm lint
• pnpm release:preflight
• NPM_TRUSTED_PUBLISHING=true pnpm release:preflight fails intentionally for the missing React package
• NPM_TOKEN=dummy NPM_TRUSTED_PUBLISHING=true pnpm release:preflight passes

[jrkropp]

Release state after the partial 0.2.0 publish:

• @jrkropp/codex-js@0.2.0 is published on npm.
• The missing GitHub tag/release for @jrkropp/codex-js@0.2.0 has been repaired.
• @jrkropp/codex-js-react@0.2.0 is not published yet because npm rejected first publish of the new scoped package name under OIDC-only trusted publishing.

Recommended order to finish 0.2.0 cleanly:

1. Add a temporary GitHub repo secret named NPM_TOKEN with npm publish/create-package permission for the @jrkropp scope.
2. Merge this PR. The release workflow should pass preflight and Changesets should publish the still-unpublished React package.
3. After npm shows @jrkropp/codex-js-react@0.2.0, configure trusted publishing for @jrkropp/codex-js-react with repository jrkropp/codex-js, workflow file release.yml, and no environment.
4. Remove or revoke the temporary token if you want OIDC-only publishing going forward.

This PR prevents future additions of brand-new package names from partially publishing other packages first.