Harden releases and fix keyboard focus

[VODuda]

Changes

• Keep keyboard focus after pagination, selection, preview, and execution. Do not reclaim focus if the user moves elsewhere while a request is pending.
• Add a generated model for scope changes and token races, including stale events after A → B → A.
• Separate release validation from an approval-gated publishing job. Pass the tested tarball by immutable artifact ID, verify its digest and manifest, and publish without running package scripts.
• Document the release process and the main-branch and release-tag protections now configured on GitHub.

The package API and version are unchanged. This does not publish a release.

Checks

• npm run check on Node 22 and 24: passed.
• 96 core tests, 43 release checks, and 20 controller/server tests: passed.
• 48 Chromium, Firefox, and WebKit checks against the published RC tarball: passed.
• Coverage: 95.57% lines, 92.28% branches, 100% functions.
• actionlint 1.7.12: passed.

Registry follow-up

The npm trusted publisher still needs its environment narrowed to npm-publish. That setting is behind the maintainer's security-key verification. The GitHub environment and approval rule already exist, but the old environment-free npm trust must be replaced before the approval gate can be considered fully enforced. End-to-end OIDC publication will be verified on the next authorized release.