fix: make plugin release safely resumable

[superche]

Summary

• retry MCP registry visibility after publish, matching the existing dependency verification behavior
• allow a release rerun only when an occupied MCP version is byte-for-byte identical to the freshly packed candidate
• keep mismatched occupied versions as a hard failure
• add regression coverage for recovery ordering, exact artifact comparison, and retry behavior

Incident

The 0.3.0 publish succeeded through npm Trusted Publisher, but the immediate registry lookup briefly returned 404. A rerun then stopped at the preflight occupied-version guard before it could complete the official-registry install and launcher smoke.

Validation

• npm test -- scripts/plugin-release-workflow.test.ts (4 passed)
• npm run lint
• npm run typecheck
• git diff --check