fix(release): handle registry visibility after npm publication

[LucienSong]

Publishing can succeed while the first registry installation still returns ETARGET for the new version. Refresh registry metadata and retry only that exact missing-version error twice, with bounded waits; other install failures still fail immediately. Archive validation and real package checks are unchanged.

Add a read-only verify_only workflow dispatch so an existing npm version can complete acceptance without attempting to republish it. Normal tag publishing remains the default.

Validation:

• Reproduced the immediate exact-version ETARGET failure before the change.
• With one simulated visibility delay, the updated checker installs the real public package and passes imports, declarations, CLI and EVM/PQABI compilation.
• Persistent exact-version misses stop after three attempts; unrelated dependency errors are not retried.
• JavaScript syntax and actionlint validation passed.
• Required hosted CI and review checks.