fix: publish verified local tarballs

[witqq]

Summary

• publish the already-downloaded and SHA-256-verified local Release asset instead of its remote URL
• preserve the no-checkout, no-build immutable publication contract
• add a regression assertion forbidding remote URL publication under npm 12

Verification

• npm 12 publish --dry-run accepts the exact local v0.6.0 core tarball
• actionlint passes
• npm run check:workflows passes
• git diff --check passes

Both earlier runs failed before the first npm publication. The v0.6.0 GitHub Release assets remain unchanged.

Made with Moira