[P2][ci] Pin JSR publish CLI to exact version

[cevheri]

Summary

JSR publish job runs npx --yes jsr publish without pinning the CLI version. A publish-capable OIDC token is exposed to whatever @latest resolves to at run time — supply-chain risk.

Audit ID: Section 2 Med — Wave 2
Note: npm provenance tracked separately in #7.

Root cause

.github/workflows/publish.yml:84:

- run: npx --yes jsr publish

Fix

Pin exact version, e.g.:

- run: npx --yes jsr@0.13.4 publish

Look up current jsr CLI version in lockfile or npm registry at implementation time; document bump process in workflow comment.

Acceptance criteria

• JSR CLI version pinned in publish.yml.
• Workflow comment explains how to bump.
• No changeset (CI only).

Verification

• Dry-run or review workflow syntax; full verify on next release.

[cevheri]

Implemented and shipped in PR #43 (merge commit 69f7161), released as v0.2.0. The PR description's comma-separated Closes list only auto-closed the first reference — closing manually. For #39/#28-style partials: the shipped scope is done; the real-browser verification half of #39 continues under #10, and the typed-error contract (#28) shipped as LibreDbError with stable codes across kernel, adapters, lenses, and CLI.