fix(release): replace fragile stable FINALIZE CLI parsing

[kattsushi]

Problem

Stable FINALIZE published all seven stable packages successfully, but both the initial run and an exact replay ended red with npm did not converge: 7.

Evidence

• Initial FINALIZE: 33285367294
• Exact replay: 33285609012
• Registry verification showed all seven target versions and latest tags had converged; alpha and beta remained unchanged.
• npm view <package> versions --json emits a pretty-printed multiline JSON array in the real runner.
• The Bash reconciler concatenated that document with a second JSON document and parsed only the first line, so JSON.parse received [ and classified every npm state as unreadable.

Expected behavior

FINALIZE must consume external command results through structured, fail-closed adapters. An all-existing replay must verify exact state and perform zero mutations.

Proposed scope

• Move stable FINALIZE orchestration to Node while retaining the shell entrypoint as a compatibility wrapper.
• Parse npm JSON documents independently and completely.
• Classify GitHub Release state through HTTP status rather than localized CLI stderr.
• Parse annotated remote tags strictly, including the peeled SHA.
• Add a read-only structured preflight and a hermetic interruption/replay matrix using realistic CLI output shapes.

Acceptance criteria

• Pretty multiline, compact and scalar npm output are handled correctly.
• Malformed output and transport/auth/rate-limit failures remain unknown and cannot authorize publication.
• GitHub 404 alone means an absent Release; other failures remain unknown.
• Exact annotated tags, Releases, npm versions, latest, and unchanged alpha/beta are verified.
• Preflight cannot invoke any mutation.
• All-existing replay performs zero mutations.
• Runtime and policy contract suites pass without changed-file lint warnings.

[kattsushi]

Reopening: the first live verification-only replay exposed that execution authorization and immutable artifact identity were still coupled. The follow-up separates EXPECTED_SHA from ARTIFACT_SHA and adds a real read-only workflow preflight before FINALIZE.

[kattsushi]

Resolved and verified end-to-end. PR #267 separates execution authorization from immutable artifact identity and adds a read-only workflow preflight. Live preflight run 33292798170 succeeded with zero FINALIZE/npm-auth steps. Historical verification-only FINALIZE run 33292885936 then succeeded. External verification confirms all seven annotated tags peel to f531cd1, all seven Releases are non-draft/non-prerelease, all seven npm stable versions and latest tags are exact, and alpha/beta tags remain unchanged.