fix: recover alpha.1 registry publication

[tensornull]

Summary

Fix the Registry Alpha publication failure without changing the immutable v0.1.0-alpha.1 tag or release.

The first Publish run (30250013146) passed immutable-release verification, exact artifact tests, and the bounded live smoke, then failed before writing to npm because npm publish release-artifacts/cometapi-0.1.0-alpha.1.tgz was parsed as a GitHub shorthand instead of a local tarball path.

This change:

• resolves the artifact directory to an absolute path before invoking npm publish
• adds a regression test proving npm receives an absolute tarball path
• adds a temporary, fail-closed manual recovery path to publish.yml
• restricts recovery to the canonical repository, main, immutable v0.1.0-alpha.1, and a supplied failed release run whose exact-artifact and live-smoke jobs succeeded
• downloads the original verified artifact from that run, requires the protected npm environment, publishes with provenance, and repeats the full registry verification

The temporary recovery entry point will be removed in the post-publication closeout PR.

Verification

• npx vitest run tests/publish-artifact.test.mjs tests/workflow-contract.test.mjs tests/ci-workflow.test.mjs (16 passed before the final full run)
• npm run actionlint
• npm run verify (11 files, 178 tests; package, fixtures, compatibility, secret/history, workflow, and standalone gates passed)
• node scripts/validate-release.mjs --tag v0.1.0-alpha.1 --release-prerelease true --require-final --require-releasable-docs

Observed remote boundary before this PR:

• Release run: https://github.com/cometapi-dev/cometapi-node/actions/runs/30250013146
• Exact artifact job: passed
• Bounded live-smoke job: passed
• Publish job: failed before registry write
• npm view cometapi@0.1.0-alpha.1: E404
• Source artifact: npm-package-0.1.0-alpha.1, unexpired, digest sha256:299be7d6e66ee0a2b7c3331d542292021456b0cf2ad87fb91ddfe579bb14de20

Checklist

• The change is within the current roadmap milestone.
• Public behavior, compatibility claims, and examples are documented.
• Unit, mocked contract, type, lint, format, build, and package checks pass as applicable.
• Packed ESM, CommonJS, and compatible-OpenAI host fixtures pass as applicable.
• No credential, private prompt, customer data, generated build output, or local dependency directory is included.
• Workflow edits pass the repository-pinned actionlint version.
• Remote Actions, live API, and registry evidence are separated from local validation.