ci(release): unify tag-format validation across publish-release and publish-npm

[stackbilt-admin]

publish-release in .github/workflows/release.yml strictly validates the tag format at its Verify tag step:

if [[ ! "${TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
  echo "Invalid tag format: ${TAG}. Expected v<major>.<minor>.<patch>" >&2
  exit 1
fi

publish-npm has no such check. It strips the v prefix and proceeds:

EXPECTED="${TAG#v}"

Since the two jobs are independent (no needs: edge), a malformed tag dispatch (e.g., gh workflow run release.yml -f tag=v1.0-rc1) would fail publish-release's Verify tag step, but publish-npm would still attempt to run with a potentially invalid version comparison.

Options

1. Add the same regex check to publish-npm's Verify-versions step as a precondition.
2. Make publish-npm depend on publish-release via needs: [publish-release] so tag validation gates both.

Low-risk today (operator-triggered only), but the ergonomic inconsistency is worth closing. Mild preference for (1) since one job failing shouldn't block the other — keeps jobs independent.

Originally flagged by CodeBeast review of #118.

[stackbilt-admin]

Implemented locally as part of the release-hardening pass.

Change:

• Updated .github/workflows/release.yml so publish-npm now validates the same ^v<major>.<minor>.<patch>$ tag format before deriving EXPECTED="" and checking workspace versions.

Verification:

• pnpm run publish:check still passes.
• Release packing logic was exercised locally against all 11 packages and produced the expected tarball names.

This keeps publish-release and publish-npm independent while making their tag precondition consistent.