Make release dry-runs safe after publication

[AdmilsonCossa]

Summary

• assign a unique ephemeral prerelease version only during dry-run jobs
• use a non-latest dry-run dist-tag
• enforce both properties in the release policy gate

Evidence

• local npm publish dry-run completed for the ephemeral version without publishing
• 424 tests passed with 100% statement, branch, function, and line coverage
• release policy and diff checks passed
• full local verify reached the Bun consumer fixture; Bun is provisioned and verified in CI

Why

npm 12 correctly rejects a publish dry-run when the repository version is already present in the registry. The real release path remains unchanged and still requires a matching signed tag.