release: harden Cargo and npm publish recovery checklist

[Hmbown]

Problem

The v0.8.51/v0.8.52 release train left too much publish state to ad-hoc terminal history: Cargo crates, npm package, GitHub Release assets, and the deprecated legacy npm package all need separate checks.

Goal

Turn the manual Cargo/npm recovery flow into a clear, reproducible checklist or script so a maintainer can recover a release without guessing.

Acceptance criteria

• The checklist starts from live truth: git tag, GitHub Release, workflow run, Cargo registry, npm registry, and local workspace version.
• Cargo publish uses the workspace dependency order and skips crates that are already visible on crates.io.
• npm publish verifies codewhaleBinaryVersion matches the release version and confirms codewhale@VERSION after publish.
• The legacy deepseek-tui npm package remains deprecated and is explicitly not republished.
• OTP/login failure paths are documented with the exact next command to rerun after authentication.
• The final verification command reports a concise pass/fail summary for Cargo + npm + legacy package state.

[Hmbown]

Status update: the Cargo publish-order and crates.io visibility-check slice from #2646 is already included on the v0.9 stewardship branch as 05950d1d5, and #2762 is green at 15c506b77.

Verified locally on the stewardship branch with bash -n scripts/release/crates.sh scripts/release/publish-crates.sh, bash scripts/release/publish-crates.sh dry-run, and ./scripts/release/check-versions.sh. Leaving this issue open for the remaining npm recovery, legacy package state, OTP rerun guidance, and final Cargo+npm verification acceptance criteria.