Harden npm publish verification

[BotondCsereklye]

Summary

• canonicalize the npm CLI binary path used during publication
• verify publish metadata without lifecycle scripts and retain package-content safeguards
• handle already-published versions by falling back to an npm pack dry run while keeping auth and 2FA failures fail-closed
• document npm 2FA and safe publishing practices

Validation

• npm run prepublishOnly
• 58 tests passed
• 90.81% statement coverage and 83.88% branch coverage
• package verification: 130 files, 68.6 kB
• Codex Security working-tree scan: 0 findings