v1.0.0 ci: stage npm release for 2FA approval

[tiagolauer]

Summary

• replace direct npm publication with staged publishing and 2FA approval
• validate the exact release tag across every CI job and the staged package
• scope OIDC permission to the staging job and pin the npm release client
• document the staged release sequence and Trusted Publisher permissions

Root cause

Release run 32421461186 exchanged the GitHub OIDC token successfully and signed provenance, but npm rejected the final direct publish request with E403. The staged flow keeps trusted publishing while moving the final registry publication behind an explicit maintainer review with 2FA.

Verification

• npm test
• npm run test:package
• npm test --workspace @owlsql/ts-plugin
• npm run test:architecture
• npx vitest run packages/core/tests/architecture/dependencies.test.mjs
• workflow YAML parse and release-tag guard checks
• git diff --check

Post-merge validation

• allow only npm stage publish for the npm Trusted Publisher
• run gh workflow run Release --ref master -f release_tag=v1.0.0
• inspect the package under npm Staged Packages
• approve it with 2FA
• verify @owlsql/core@1.0.0 and its provenance from a clean install