fix: publish alpha.3 through npm OIDC

[tensornull]

What changed

• allow the fixed actions/setup-node authentication sentinel used by npm Trusted Publishing
• continue rejecting real NODE_AUTH_TOKEN credentials and every NPM_TOKEN
• add regression coverage for the setup-node sentinel
• advance the release candidate and public documentation to 0.1.0-alpha.3
• preserve the immutable, unpublished alpha.2 failure as release evidence

Root cause

The alpha.2 release passed exact-artifact verification and bounded live smoke, but scripts/publish-artifact.sh treated setup-node's fixed XXXXX-XXXXX-XXXXX-XXXXX sentinel as a real registry token and exited before invoking npm.

Verification

• node scripts/validate-release.mjs --tag v0.1.0-alpha.3 --release-prerelease true --require-final --require-releasable-docs
• npm run verify
• 176 tests passed
• package, ESM, CommonJS, compatible OpenAI host, compatibility, self-containment, public-preview, secret scan, and actionlint gates passed