ci: keep publish dry-runs out of registry environments

[jaberjaber23]

Summary

• split dry-run npm/PyPI verification into read-only jobs without protected registry environments
• keep real npm/PyPI publish jobs behind environment approval, OIDC, strict promotion gate, exact artifact reuse, leak checks, and registry install checks
• strengthen workflow-policy tests so job-level dry_run guards and registry upload command drift are caught

Verification

• node scripts\verify-workflow-policy.mjs
• pnpm --dir typescript exec tsc -p tsconfig.json --noEmit
• pnpm --dir typescript test
• python -m pip install -e python
• python -m pytest python/tests/ -v

Review

• second-opinion review found two policy blind spots; both are fixed in this PR.