fix(release): make publish idempotent + verify packages landed on the registry

The first 0.9.0 run published 6/7 npm packages: npm printed
`+ @colbymchenry/codegraph-linux-x64@0.9.0` but the registry never persisted it
(a known npm flake), so the job went green while linux-x64 npm installs were
broken. Now:
- the GitHub Release step is idempotent (create, else upload --clobber);
- the publish loop skips packages already on the registry, so a re-run only fills
  gaps;
- a new verify step queries the registry (with retries) and fails the job if any
  package@version is missing — green now means actually shipped.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>