add standalone npm publish workflow

[iamalwaysuncomfortable]

Motivation

The npm job in release.yml only runs as part of a full release, and it checks out the release tag — so there is no way to publish npm packages for an existing release (e.g. backfilling v0.2.0, whose tree predates the npm scripts), or to recover if the npm job fails after the GitHub release is already published (expired NPM_TOKEN, registry flake, partial platform publish).

This adds a manually-dispatched npm-publish.yml that takes an existing release tag, downloads its binary zips with gh release download, assembles the packages with scripts/build-npm.mjs, and publishes. Two deliberate differences from the release-path job:

• It checks out the default branch, not the tag, so the packaging scripts are always present regardless of the tag's tree.
• The publish loop skips packages already on the registry, so a partial earlier publish can be resumed idempotently. Main launcher still publishes last so its exact-pinned optionalDependencies always resolve.

Test Plan

Dry-ran each shell step locally against fake release assets:

• zip extraction produces the bins/<rust-triple>/aleo-devnode[.exe] layout build-npm.mjs expects (all 5 targets)
• build-npm.mjs --version 0.2.1 assembles all 6 packages from that layout
• publish loop ordering (platforms first, main last) and the npm view skip path verified (skips a published version, proceeds on 404)
• YAML validated with js-yaml

Related PRs

#22, #23

🤖 Generated with Claude Code