fix: harden post-publication convergence

[tensornull]

Summary

• retry delayed npm attestation availability through a bounded, atomic fetch
• re-read exact version, latest, next, integrity, and attestation identity after convergence
• prevent an idempotent replay from republishing when protected preflight already found the version
• codify the single failed-job recovery path in repository release rules

Root cause

The v0.1.2 OIDC publication succeeded, but npm package metadata exposed an attestation URL roughly eight minutes before that endpoint returned 200. The workflow fetched it once after about thirteen seconds, received 404, and failed after immutable registry mutation. Shell-redirected curl retries could also preserve partial response bytes.

Verification

• npm run verify (538 source tests and 538 isolated-copy tests)
• actionlint 1.7.12
• behavioral 404-to-200, partial-transfer-to-200, and exhaustion tests
• post-convergence registry drift mutation tests
• idempotent existing-artifact and replay E404 tests
• git diff --check

[tensornull]

LGTM

Reviewed and accepted exact head 05041c4.