[codex] Harden release publishing retries

[jooh]

Summary

• switch PyPI publishing to PyPA's trusted-publishing action with skip-existing so reruns can recover from partial releases and avoid the uv publish upload path that failed
• teach the npm publish helper to skip package names not yet registered for trusted publishing and prune unavailable native packages from wrapper optional dependencies for that publish
• document the registry preconditions and cover the release workflow behavior with tests

Root Cause

The post-merge devcontainer-release run failed after a partial publish: PyPI accepted some 0.0.45 wheels before rejecting the Linux arm64 wheel, and npm trusted publishing could not publish newly introduced Linux arm64 native package names that are not registered/configured on npm yet.

Validation

• node --test build/test-publish-npm-packages.js
• node build/check-npm-publish-workflow.js
• make npm-package-smoke
• make npm-publish-script-check
• make npm-publish-workflow-check
• make tests