Fix release/publish workflows and enforce pnpm workspace dependency resolution

[cbassuarez]

Motivation

• Prevent CI from fetching internal @flux-lang/* packages from the npm registry by forcing pnpm workspace resolution.
• Eliminate ts-node/esm runtime usage in CI/publish flows which caused loader/cycle errors and blocked publishing.
• Keep release tooling deterministic so the stable release job can self-heal dist artifacts, lockfile mismatches, bump patch versions, and push tags via a PAT to trigger publishing.

Description

• Add a root .npmrc with link-workspace-packages=true and prefer-workspace-packages=true to force workspace resolution.
• Replace internal @flux-lang/* version ranges in workspace packages/*/package.json files with workspace:^ so pnpm resolves them locally.
• Update scripts/release/syncVersions.ts to preserve internal workspace ranges by always writing workspace:^ for internal deps instead of expanding to semver.
• Add a release scripts CommonJS boundary by creating scripts/release/package.json with { "type": "commonjs" } and update scripts/release/tsconfig.json to compile to CommonJS with moduleResolution: Node and outDir: dist.
• Update workflows to use pnpm (cached store approach), compile the release scripts, and invoke the compiled CJS JS instead of node --loader ts-node/esm; this includes .github/workflows/publish.yml, .github/workflows/publish-canary.yml, and .github/workflows/ci.yml changes.
• Add pnpm store caching steps to publish workflows and adjust install/build/test steps to pnpm install --frozen-lockfile, pnpm run build, and pnpm test so CI never runs npm ci against workspace packages.

Testing

• No automated tests were executed as part of this change; CI workflows were updated to run pnpm install --frozen-lockfile, pnpm run build, pnpm test, and compile release scripts so upstream CI should validate the end-to-end behavior when the workflows run.

---

Codex Task