fix: recover publish from immutable tag

[tensornull]

Summary

• replace the failed main-push recovery with an exact v0.1.1 deployment trigger accepted by the existing npm environment tag policy
• validate the immutable release commit, reviewed control merge, source Release Please run, exact artifact, environment-policy failure, and bounded live-smoke evidence
• reuse the already successful three-request live smoke while repeating offline package and artifact gates before OIDC publication
• document the true failure state and the one-cycle recovery/cleanup contract

Verification

• npm ci
• npm run verify (407 tests, package/tarball, publint, Are the Types Wrong, examples, ESM/CJS/OpenAI host fixtures, minimum/locked/latest OpenAI 6.x, standalone copy, actionlint)
• git diff --check
• validator replay against run 30471665743 jobs, artifact, annotation, and live-smoke log

Release constraints

This PR does not modify the npm environment, Trusted Publisher, secrets, ownership, tag, GitHub Release, or registry. After merge, an authorized human-created deployment for immutable v0.1.1 is still required, and npm publication remains gated by the existing human environment approval.