Fix trusted-publishing tarball recovery

[orangebtc]

What changed

• publish local candidate tarballs with an explicit ./ path so npm does not parse them as GitHub package specs
• add a guarded workflow-dispatch recovery path that always checks out and validates the immutable version tag
• bind the candidate manifest to both the immutable release commit and the workflow commit

Why

The v0.4.0 trusted-publishing run validated and packed successfully, but npm interpreted release-candidate/<file>.tgz as a Git dependency. The version was not published.

Validation

• git diff --check
• exact candidate build, tests, package allowlist, and production audit passed in release run 30158750617 before the final command failed
• recovery remains tag-bound and refuses existing package versions