fix(release): skip native scripts during npm setup

[code-yeongyu]

Problem

The npm release workflow ran dependency lifecycle scripts even though release validation only needs TypeScript and test dependencies. On the current Linux runner, Canvas had no compatible prebuild and its source fallback failed because pangocairo development headers are not installed.

Failed run: https://github.com/code-yeongyu/senpi/actions/runs/31675074971

Fix

• Install release dependencies with --ignore-scripts.
• Add a workflow contract test for the exact install command.
• Record the workflow invariant in .github/changes.md.

Native artifacts remain explicitly rebuilt in the separate binary release workflow.

Verification

• Focused workflow test — 3/3 passed.
• Root script suite — passed.
• npm run check — passed.
• Root workspace build — passed.
• actionlint .github/workflows/publish-npm.yml — passed.
• Exact no-script install — passed.
• No v2026.8.13 tag or npm version exists.

---

Summary by cubic

Skip native lifecycle scripts during dependency install in the npm release workflow to keep release validation independent of native toolchains. Previously npm install ran package scripts (e.g., canvas build) and failed on missing pangocairo; now we install with --ignore-scripts so TypeScript and test dependencies install cleanly.

• Change: in .github/workflows/publish-npm.yml, the install step uses npm install --ignore-scripts --no-audit --no-fund.
• Test: scripts/publish-workflow.test.mjs asserts the exact no-script install command.
• Docs: record the workflow invariant in .github/changes.md.
• Scope: affects only the npm release workflow; native artifacts remain in the separate binary release workflow.
• Migration: none required. If any package relied on install-time scripts for release validation, move that logic into the build step or the binary workflow.

^{Written for commit 521b219. Summary will update on new commits.}