ci: move npm releases to admin-dispatched GitHub Actions

[yedidyak]

Summary

• Replace the expired-token Buildkite publisher with an admin-dispatched GitHub Actions workflow using npm trusted publishing. It prepares and validates immutable tarballs on Linux, publishes through OIDC, and creates version branches, tags, GitHub releases, and version/documentation PRs.
• Support dry runs, explicit stable/prerelease versions, on-demand snapshots, and recovery of the original bytes after partial failure. Validate both dispatch/rerun administrators, originating workflow/artifacts, exact-SHA Buildkite status and its creator, package integrity, and monotonic release channels.
• Remove the legacy release/publish pipelines, release script, gren config/dependencies and obsolete badge. Lock optional documentation builds and document setup, recovery, infrastructure cleanup, and the adapter requirements for Detox/UI-lib.

Validation

• Bob build and npm 11.17.0 tarball inspection passed; Android/iOS source files and exported entry points are verified without Android SDK or Xcode.
• node scripts/test-js.js passed: 38 suites, 405 tests, 4 snapshots (11 suites/59 tests already skipped).
• node --test scripts/release/*.test.cjs passed: 27 tests, including unauthorized reruns, forged CI statuses, workflow identity, artifact/commit integrity, lost publication responses, and multi-package partial recovery.
• Actionlint 1.7.7 passed for both new workflows and the documentation workflow; documentation helper ESLint and git diff --check passed.

Not Run

• GitHub Actions is currently disabled for this repository (actions/permissions: enabled=false), so neither the new package check nor existing documentation check started on this PR. A repo/org admin must enable Actions before these can validate the change.
• Clean local immutable Yarn installation reached fetch but failed with environment network errors (ENOTCONN/EBADF). The regenerated lock completed repeated Yarn lock-only validation; the new Linux package job will verify a clean full install after Actions is enabled.
• Website npm ci --legacy-peer-deps failed on the existing sharp 0.27.2 Darwin ARM/libvips dependency; its build awaits the Linux documentation check after Actions is enabled.
• Real npm OIDC publication requires the workflow on master and the npm trusted publisher/environment setup documented in docs/RELEASING.md.
• Native builds were not rerun locally; existing Buildkite native testing remains and successful trusted status on the exact source SHA gates real publication.

Risks

• npm and GitHub mutations are not atomic. Recovery verifies existing package integrity and never silently changes versions or overwrites conflicting refs.
• A missing npm version must be published by its original source workflow run to preserve provenance; a newer resume dispatch can finish bookkeeping for an already published matching version.
• The first real release remains disabled until RELEASE_PUBLISH_ENABLED=true is configured. No old publishing overlap or expired-token fallback is retained.

Review Context

• npm trust: wix / react-native-navigation / release.yml / npm-release environment; direct publication must be enabled. Configure the environment for master and allow Actions-created PRs.
• Only the publisher receives id-token: write; package building does not receive npm publication credentials.
• Engine notification is intentionally excluded. Shared secrets and native/documentation consumers remain; the runbook identifies external cleanup.
• The new website lockfile accounts for most added lines. Removing gren prunes its obsolete dependency tree from the root Yarn lockfile.

Suggested Reviewers

• @yogevbd — dominant contributor across the existing release and documentation scripts in git history.