fix(release): harden npm publish recovery

[oscharko]

Summary

• retry npm registry visibility checks after publish before failing the release
• skip Yarn registry smoke for the root-only package mode where private runtime workspaces are bundled instead of independently published
• add regression coverage for delayed npm visibility and the root-only bundled smoke path

Verification

• npx vitest run scripts/__tests__/release-publish-pipeline.test.mjs scripts/__tests__/registry-install-smoke-security.test.mjs
• npx vitest run scripts/__tests__/release-publish-pipeline.test.mjs scripts/__tests__/registry-install-smoke-security.test.mjs scripts/__tests__/check-publish-manifests.test.mjs
• npm run format:check
• npm run check:publish-manifests
• npm run release:plan -- --tag latest
• npm run typecheck
• npm run lint
• npm run arch:check
• npm run arch:check:negative
• npm test

Notes

• KEIKO_REGISTRY_INSTALL_PACKAGE=@oscharko-dev/keiko@0.2.13 npm run smoke:registry-install timed out locally in the npm install step after 300s. The failed release workflow had already shown npm installation passed in CI and failed specifically in Yarn resolution of private workspace packages; this PR covers that failure deterministically.