fix: publish GitHub release notes after npm releases

[kmbroai]

Summary

• Explicitly dispatch the verified GitHub release workflow after protected npm publication so bot-dispatched releases no longer depend on a suppressed event.
• Remove the obsolete workflow_run trigger and its event-derived tag/run fallback; manual backfills continue through workflow_dispatch.
• Isolate actions: write from npm signing and preserve exact release-tag, source-commit, workflow-run, and provenance verification.
• Wait briefly for the publishing workflow to finish, and fail safely on mismatched runs or a bounded timeout.

Validation

• Focused release automation and release-cut suites: 193 passed.
• Full randomized SDK suite: 950 passed, 10 expected platform/integration skips.
• Ownership-security negative controls passed.
• TypeScript typecheck/model generation, package build, and Prettier formatting passed.
• Parsed both workflow YAML files and validated the modified Bash scripts.