build: harden release inputs and isolate test bundles

[PathGao]

Summary

• Use npm ci in release builds so the resolved dependency graph matches the lockfile.
• Stop uploading portable Windows executables under installer-like names.
• Add an isolated macOS test-bundle builder requiring a non-production bundle identifier.
• Add workflow regression tests and update release documentation.

Scope

This is independent of the current Stack. It is related to the release hardening tracked in #334, but does not claim to resolve the pending Defender investigation.

Validation

• npm ci
• npm run check
• npm test (152 passing)