Finalize Public Preview validation

[tensornull]

Summary

• align the scheduled live-smoke comment and release authorization wording with the accepted environment approval policy
• replace structural assertions with behavior tests for Public Preview aggregation, standalone edge cases, and npm publication authentication
• extract the tested artifact publication logic without changing its OIDC-first or alpha.1-only policy
• record cometapi-team as the maintainer-confirmed npm owner verification target after first publication

Why

The final review found stale reviewer wording, insufficient behavior-level evidence, and no durable owner closeout for an npm package that does not exist yet.

Impact

The runtime SDK and supported API surface are unchanged. Trusted Publishing remains the default, the token fallback remains restricted to 0.1.0-alpha.1 on next, and repository visibility remains private.

Verification

• npm run verify
• npm run check:standalone-content
• bash -n scripts/publish-artifact.sh
• git diff --check

Local verification passed 99 tests plus package, fixture, compatibility, workflow, secret, and standalone-copy gates.