ci: publish reviewed main versions without Actions PRs

[MLittleprince]

Summary

• publish only versions already reviewed and committed on main; the workflow no longer edits source versions, pushes a release branch, or creates a version writeback PR
• validate package.json, openclaw.plugin.json, moltbot.plugin.json, and clawdbot.plugin.json at the immutable release ref before any publish
• record the Dry-run source_commit, require the exact 40-character commit for a real publish, and stop before npm if main moved after approval
• route stable and prerelease versions deterministically:
  • X.Y.Z + latest -> npm stable + published GitHub Release + formal Docs sync
  • X.Y.Z-beta.N + beta (or alpha/next) -> npm preview + GitHub Prerelease; 106 skips the formal Docs PR
• keep metadata recovery pinned to npm gitHead, and fail closed if recovery is requested for a version that does not already exist on npm
• remove pull-requests: write; this flow does not require Allow GitHub Actions to create and approve pull requests

Release-owner workflow after merge

1. Update all four version files in a normal reviewed PR and merge it to main.
2. Run OpenClaw Cloud Plugin — Publish & Release with dry_run=true.
3. Review the inspection artifact and copy release-source.json.source_commit.
4. Run the same workflow with dry_run=false, the same version/channel, the exact source_commit, and PUBLISH v<VERSION>.
5. For stable releases, review the MemOS-Docs PR created by 106. Prereleases intentionally stop before Docs/pre/gray.

Validation

• npm test — 120/120 passed
• release policy/source/inventory contract tests — 15/15 passed
• actionlint — passed
• all workflow YAML files parsed successfully
• git diff --check — passed
• npm pack --dry-run --json — passed, 17 package files
• committed source gate:
  • 0.1.20-beta.0 against current HEAD — passed
  • 0.1.20 against current HEAD — correctly failed and reported all four mismatched files
• 106 scripts/test_release_sync.py smoke tests — passed, including prerelease -> skip_prerelease and would_create_docs_pr=false

No npm publish, tag, GitHub Release, or production deployment was triggered while preparing this PR.