ci: require opt-in for manual npm publish

[mertushka]

Purpose

Prevent a routine manual Release workflow dispatch from publishing to npm or recreating a prerelease distribution tag unintentionally.

Changes

• default manual publish_npm input to false
• clarify that npm_tag applies only when npm publication is explicitly enabled
• document asset-only defaults and the explicit manual publication procedure

Impact

• Automatic GitHub Release publication: unchanged
• Manual asset rebuilds: safer default; they still build and replace release assets
• Manual npm publication: still supported through explicit publish_npm opt-in
• Public/runtime behavior: none
• Native addon: none
• WPT/conformance: none
• Browser interoperability: none

Validation

• npm run check
• git diff --check
• actionlint 1.7.12 across all workflows using the previously checksum-verified upstream Windows binary