Harden npm release supply chain

[Zk-nd3r]

Summary

Hardens the npm release path against the Keyv/cacheable supply-chain attack class where compromised source and CI can still produce valid npm provenance.

• pins every GitHub Action to a full commit SHA
• suppresses dependency lifecycle scripts in CI and release verification
• adds a fail-closed supply-chain policy and adversarial mutation tests
• isolates OIDC to one minimal publish job
• requires an annotated tag reachable from origin/main
• verifies the fresh publish-job tarball is byte-equivalent to the preflight manifest before registry mutation
• separates post-publish registry verification from the OIDC job
• documents that provenance proves build origin, not source benignness

Validation

• supply-chain policy and YAML/OIDC mutation suite
• prepublish equality mutation suite
• 23/23 verifier tests
• release-gate fixtures
• browser packed-artifact matrix
• npm audit signatures
• npm audit: 0 vulnerabilities
• YAML parse and clean diff checks

Release boundary

Publication remains held. This PR does not create or move a tag and does not publish npm. A future release remains blocked until npm stage-only trusted publishing, package-level disallow-token/2FA controls, and independent main/tag protections are verified. Existing v0.2.1 is unchanged.