fix: publish verified tarballs by absolute path

[lim5max]

Summary

• make both Trusted Publisher jobs pass the downloaded tarball to npm by an absolute filesystem path
• prevent npm from interpreting release/name.tgz as a GitHub shorthand package spec
• add regression assertions for MCP and SDK workflows

Evidence

• real failed publish jobs verified SHA-512, then stopped with git ls-remote ssh://git@github.com/release/...tgz.git; npm registry was not written
• SDK release tests: 3/3 passed
• MCP package/config tests: 9/9 passed
• clean merge-tree against current main