Wait for trusted npm publish propagation

[jeremymcs]

Summary

• add a bounded wait after trusted npm publish before verifying @latest
• keep the final @latest assertion so real tag failures still fail the release

Verification

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/npm-publish.yml"); puts "yaml ok"'
• git diff --check
• custom workflow-shape assertion for the trusted publish propagation loop

Release follow-up

• v0.2.1 is published to npm as @latest
• GitHub release v0.2.1 is stable and has all five assets

---

Note

Low Risk
CI-only change to release workflow timing; no application or publish semantics beyond tolerating npm registry propagation delay.

Overview
Fixes flaky production trusted npm publishes by polling the registry after npm publish --tag latest instead of checking @latest immediately.

The Publish trusted package to @latest step now retries up to 24 times (5s apart) until dist-tags.latest matches the release version, logging the current tag while waiting. The existing hard failure if @latest still does not match after the wait is unchanged, so real promotion failures still fail the job.

^{Reviewed by Cursor Bugbot for commit 3d0b024. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is enabled.}