fix: preserve prerelease npm tag

[kauandotnet]

Summary

• publish Changesets prereleases under their configured dist tag instead of latest
• fail closed outside GitHub Actions main, on a dirty tree, or when HEAD differs from GITHUB_SHA
• restore the Changesets prerelease state after every publish outcome
• add focused prerelease-state tests

Verification

• pnpm run check
• pnpm run test
• pnpm run verify:pack
• focused publish-state tests
• publish guards fail closed locally and on a simulated dirty worktree
• git diff --check