ci: publish gated beta and next candidates

[rdlabo]

Summary

• Build immutable npm candidates in a read-only workflow with no publishing credentials.
• Publish an open PR head to the beta dist-tag only after its required CI passes and a repository administrator comments /beta.
• Publish the current main head to the next dist-tag only after all required main CI passes for that exact commit.
• Comment the immutable version and exact install command on the associated pull request.
• Keep tag-based prereleases on next.

Security and release invariants

• The privileged Release workflow never checks out or executes pull request code.
• /beta authorizes one exact PR head SHA. A new commit requires new CI and a fresh administrator /beta comment.
• The required workflow names and paths, successful source run, immutable artifact, package name, version, and npm registry are verified before publishing.
• A PR that modifies a release-gating workflow cannot be beta-published until that workflow change is on main.
• Candidate lifecycle scripts are disabled during packing and publishing.
• Candidate publishes explicitly use only beta or next. They cannot update latest.
• Only an explicit stable vX.Y.Z tag uses npm's default latest dist-tag; prerelease version tags use next.

Rollout test

After this PR lands on main, merge main into PR #131 (fix/radio-group-across-lists) without merging that feature PR. Let its CI pass, then test the administrator /beta flow and exact install comment there.

Validation

• actionlint 1.7.12 passed for both changed workflows.
• Prettier and git diff --check passed.
• CodeQL Actions and JavaScript analyses passed with no open code-scanning alerts on the current head.
• Lint, Package Candidate, and Ionic 8/9 E2E checks passed.
• The generated artifact was inspected as @rdlabo/ionic-theme-ios26@9.0.2-beta.pr132.shaa6fb35b1bd00.

[github-actions]

Playwright test results

 90 passed

Details

 90 tests across 2 suites
 1 minute, 54 seconds
 a6fb35b
 This detailed result covers Ionic 9 only. Ionic 8 runs against the same screenshots in a separate matrix job; check the workflow run for both results. To update the screenshots, comment with /update-screenshots.

[github-actions]

📊 Ionic 9 Playwright Test Report

View the detailed Ionic 9 report: https://rdlabo-dev.github.io/ionic-theme-ios26/pr-132/

Ionic 8 runs against the same screenshots in a separate matrix job. View both results in the workflow run.

[github-actions]

📊 Ionic 9 Playwright Test Report

View the detailed Ionic 9 report: https://rdlabo-dev.github.io/ionic-theme-ios26/pr-132/

Ionic 8 runs against the same screenshots in a separate matrix job. View both results in the workflow run.

[github-actions]

📊 Ionic 9 Playwright Test Report

View the detailed Ionic 9 report: https://rdlabo-dev.github.io/ionic-theme-ios26/pr-132/

Ionic 8 runs against the same screenshots in a separate matrix job. View both results in the workflow run.

[github-actions]

📊 Ionic 9 Playwright Test Report

View the detailed Ionic 9 report: https://rdlabo-dev.github.io/ionic-theme-ios26/pr-132/

Ionic 8 runs against the same screenshots in a separate matrix job. View both results in the workflow run.