release: harden npm delivery workflows

[0thernet]

Summary

• isolate npm OIDC authority in a minimal terminal staging job with no checkout, Bun runtime, or repository code, and rebind the exact three-file artifact plus current main immediately before npm stage publish
• replace cross-platform gzip-byte equality with bounded canonical package identity over exact paths, entry types, modes, sizes, and SHA-256/SHA-512 file hashes while independently verifying npm SHA-1/SHA-512 transport integrity and registry dist metadata
• add a guarded current-main recovery dispatch for an already-published stable tag, using reviewed current helper blobs by absolute path against the checked tagged-source boundary without lifecycle republishing or tag movement
• add behavioral regressions for gzip transport drift, metadata order, content/mode/link tampering, and the exact historical 0.17.1 source with its helper scripts removed
• document the stage and recovery trust boundaries

Verification

• bun run check (1,187 tests, 11,704 assertions; package smoke, build, typecheck, workflow checks, and Rust metadata helper check all green)
• focused release suite: 13 tests, 164 assertions
• every workflow run block passes bash -n after expression substitution
• live public @hraness/kb@0.17.1 comparison: 200 files, 4,860,250 unpacked bytes, canonical SHA-256 178c0342d63fe28d2f3267edbe245b37875e6b8d17cb8d5c6a4ccbe8e716580f
• dist/ and bun.lock remain clean after the full gate

Release boundary

The published source commit remains 58bd07b69dd40ad83bb2e49b5368adac75fb12fc. This PR does not create or move v0.17.1, publish or stage npm, configure trusted publishing, dispatch recovery, or create a GitHub Release.