ci: route prerelease tags to GitHub Packages

[MichalCz]

Summary

• publish stable tags directly to npmjs.org after the npmjs-release OIDC gate, then open a protected-main post-release version-bump PR
• publish prerelease tags only to GitHub Packages under next and attach Python release assets for both tag kinds
• add fail-closed tag metadata and post-release branch guards, rerun-safe registry checks, and release documentation

Validation

• npm run lint
• npm test
• npm run test:package-consumers -- --source=staging
• npm run test:package-consumers -- --source=tarball
• npm run test:package-tarballs