Graduate Yield and add public npm releases

[bigboateng]

Summary

• make this repository the canonical Yield source and remove projection sync
• publish the SDK/CLI plus six runtime packages to public npm with trusted publishing and provenance
• add canary and stable channels, Changesets release intent, immutable tags, and draft-release finalization
• keep the private registry as an independent mirror that cannot block public npm
• move the full lab validation suite into this repository
• describe guarantees through executable tests and plain technical documentation

Release flow

• pushes to main publish an opt-in canary version
• a manual release dispatch accepts auto, patch, minor, or major
• stable releases require protected environment approval and publish runtimes before the main package
• GitHub releases remain drafts until all seven public npm packages are visible at the exact version

Validation

• 15 release-control and package-assembly tests
• Go tests, vet, and build
• 6 Python SDK tests
• 40 evaluation workflows and 8 runtime checks
• 40 example workflows across TypeScript, Python, Go, and Rust
• TypeScript SDK tests, build, and package inspection
• live repository permissions, required checks, SHA pinning, and immutable-tag audit

No stable npm release is started by this PR.