release: automate protected npm staging

[0thernet]

Summary

• start the existing stage-only npm pipeline automatically when package.json reaches main with a strictly increasing stable version
• make same-version manifest edits a successful pre-verification, pre-OIDC no-op while retaining manual recovery dispatch
• gate the sole OIDC job on the protected npm-stage environment and document reviewer, self-review, branch, trusted-publisher, and npm 2FA requirements

Validation

• bun run check (1,195 tests; typecheck, build, package smoke, workflow checks, and pinned helper check)
• focused npm release workflow suite: 7/7
• focused selector and workflow-policy suites: 14/14