release: support a narrow CLI-only security publish

[willwashburn]

Problem

The production publish workflow cannot ship a narrow relayfile CLI security fix. Although workflow_dispatch exposes package=cli and the workflow contains publish-single, Validate release mode hard-fails every non-all, non-dry-run invocation. The current build also versions every package manifest, and release lockfile regeneration assumes every mount platform package exists at the new version.

The result is an over-wide irreversible action: delivering a CLI-only fix currently requires publishing 11 npm packages, six CLI binaries, four mount binaries, and checksums.txt, plus a lockstep version commit, tag, changelogs, and GitHub release. This is a present mechanism whose safety properties nobody chose.

The all-package matrix uses fail-fast: false and bare npm publish commands. A partial failure can publish an immutable version for only part of the lockstep set while preventing the tag/release job, forcing a full roll-forward version.

Acceptance criteria

• The production pipeline can version, build, test, and publish relayfile without changing or publishing the other ten npm packages.
• A CLI-only release publishes the six relayfile-cli-* assets and a checksum manifest without building or publishing the four mount packages/binaries.
• The CLI-only path preserves npm provenance, the version commit/tag, changelog handling, and a GitHub release.
• Re-running after a partial publish has an explicit, tested recovery behavior; it must not silently treat an existing registry version as success.
• Dry-run and production modes exercise the same package/artifact selection logic.

Context

Discovered while preparing the companion release for relayfile PR #380 / AgentWorkforce/relay#1380. Only the relayfile npm package and CLI assets carry that companion fix; the current workflow forces the full set.