fix(release): serialize trusted npm publishing

[kauandotnet]

Summary

• publish the fixed MCP package group sequentially to avoid concurrent npm OIDC credential exchanges
• wait for each version tarball to become publicly installable before continuing
• fail explicitly when npm metadata exists without an available tarball

Verification

• pnpm run check
• node --check scripts/publish.mjs
• git diff --check