Clarify Registry Alpha owner sequence

[tensornull]

Summary

• move cometapi-team owner setup into the common Registry Alpha sequence after the first npm publication
• make the requirement apply to both normal OIDC publication and the alpha.1 token bootstrap
• keep the bootstrap section focused on exception-only cleanup and reference the common owner gate

Why

The owner commands were nested under the conditional bootstrap section, so maintainers following the normal OIDC path could skip a requirement that applies after every first publication.

Verification

• npm run verify
• 99 tests passed in both repository and standalone-copy runs
• Public Preview, package, fixture, compatibility, actionlint, and self-contained gates passed