fix: recover npm 12 release proofs

[sarveshsea]

Summary

• normalize npm 10/11 scalar and npm 12 one-element-array output for exact npm view metadata and fields
• repair both the five-package provenance/signature proof and the clean-cache 11-tool MCP proof
• let partial-release recovery use corrected protected-main proof tooling while loading and SHA-512-verifying the historical release manifest
• preserve historical artifact, integrity, gitHead, OIDC, MCP Registry, and tag boundaries

Partial release state

Run 29522742012 published the five authorized npm artifacts from c26ad05. Its downstream proof failed on the npm 12 JSON shape, so MCP Registry publication and GitHub tag/release creation were withheld. Every live npm integrity matches the retained reviewed bundle. Recovery must skip all five existing exact versions rather than republish.

Test plan

• npx --yes npm@12.0.1 run verify
• real five-package npm metadata, integrity, gitHead, signature, and SLSA provenance proof
• real @buzzr/mcp@5.1.0 clean-cache npx proof with 11 tools
• 19 parser and release supply-chain regression tests
• release workflow structural checks, YAML parse, formatting, and diff check

Code and security review: GO with no findings.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}