ci: harden release bootstrap

[CJianYu]

Summary

• make tag-triggered publishing idempotent only when npm gitHead exactly matches the tag commit
• fail closed on version collisions from any other commit
• document the one-time local bootstrap without provenance
• serialize subprocess-heavy integration suites and use a load-tolerant timeout

Verification

• parsed release.yml with the project YAML parser
• Shiploop full proof: 20/20 tests, typecheck, lint, and build