Use npm staged publishing

[JoviDeCroock]

Summary

• stage npm releases with pnpm stage publish instead of publishing them immediately
• preserve release tags, GitHub releases, provenance, and the existing JSR publish
• move the trusted publish job to Node 22, npm 11.15, and pnpm 11.3
• remove dependency caching from publish jobs and pin release-workflow actions

npm packages now require a maintainer to review and approve the returned stage ID with 2FA before they become public. JSR does not have a staged-publish equivalent, so its existing publish remains part of the automated release job.

Verification

• simulated both already-published and newly-staged helper paths
• parsed and structurally checked the workflow
• prettier --check
• pnpm run check
• pnpm run lint
• pnpm run test --run (103 tests)
• pnpm run build
• git diff --check

No changeset: this only changes release infrastructure.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7b42800

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR