ci(release): wait for the canonical npm artifact

[ScriptedAlchemy]

Npm exposed 0.12.0 metadata before its canonical tarball was readable, so the release verifier passed and both downstream native image builds failed with E404. Require a successful HEAD request to the advertised tarball before confirming publication, within the existing retry deadline.

The actual workflow script passes against the published package and fails when metadata is ready but its tarball returns 404. Full pnpm check passes; committed generated artifacts are refreshed. OIDC publishing and credentials are unchanged.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e5645ba

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ScriptedAlchemy]

Independent review PASS for e5645ba9232d9965b79e6a1f9e93ef99c0267542.

A clean detached checkout contains only the canonical tarball HEAD success guard and regenerated input-fingerprint artifacts. The extracted workflow script succeeds against the real 0.12.0 package and canonical tarball, and exits 1 for metadata-ready/tarball-404. Committed artifact input/mode/schema/byte checks pass. Publishing, credentials, permissions, retry deadline, package version, and dependencies are unchanged. Parent full pnpm check passed.