Harden production readiness gates

[localhost41]

Summary

• add public publish guard and package repository metadata
• add a manual alpha publish workflow with npm provenance and alpha-version guard
• record the 2026-07-10 live QVAC alpha smoke validation in the validation checklist

Validation

• pnpm verify:package passed
• shared factory E2E passed with local packed artifacts: scripts/qvac-production-e2e.sh --source local

Notes

• Public benchmark claims remain blocked until a full benchmark report is filled from docs/reports/template.md.
• Requires npm trusted publishing configuration before the publish workflow can be used without a token.
• Does not promote a stable release.