fix(release): make package validation race-free

[jeremylongshore]

Summary

• make npm prepack validate generated template mirrors instead of mutating them
• add a regression assertion for the read-only packaging contract
• bound the real npm-pack artifact test for slower CI runners
• make the v3 audit status timeless and record the fix in the changelog

Verification

• 10 repeated concurrent runs of generated-accessibility + packed-artifact tests
• npm run lint
• npm run build
• npm test (192 passed, 3 optional skipped; package tests 30 passed)
• npm run verify
• npm run skill:check
• npm audit --omit=dev (0 vulnerabilities)
• npx audit-harness verify
• npx audit-harness conform . --strict (10 PASS)
• npx audit-harness escape-scan --range origin/main..HEAD (clean)

Bead: blueprint-yn2.4