Harden production readiness gates

[localhost41]

Summary

• expand CI to cover Node 20, 22, 24, and 26
• add a manual alpha publish workflow with npm provenance and alpha-version guard
• add a standalone package verifier that inspects packed files, installs the tarball into a clean consumer, checks public import/CLI help, and builds a generated app
• add package bugs/homepage metadata

Validation

• pnpm verify passed
• shared factory E2E passed with local packed artifacts: scripts/qvac-production-e2e.sh --source local

Notes

• Requires npm trusted publishing configuration before the publish workflow can be used without a token.
• Does not promote a stable release.