fix(ci): tolerate npm candidate tag cleanup failures

[pallyoung]

What changed

• keep npm candidate dist-tag cleanup best-effort after CLI acceptance
• keep the final npm dist-tag promotion as a required, fail-fast operation
• emit a GitHub Actions warning when npm policy rejects temporary tag deletion
• add workflow boundary assertions for both cleanup paths

Root cause

The CLI candidate was packed, validated, published/reused, and passed isolated upgrade acceptance, but npm returned E403 for dist-tag deletion. Treating temporary tag deletion as release-critical marked acceptance as failed and could also block Git tag/GitHub Release creation after a successful latest promotion.

Impact

Temporary rc run tags may remain if npm denies deletion, but candidate acceptance and formal promotion are no longer falsely blocked. Adding the requested final dist-tag remains mandatory.

Validation

• Workflow boundary test: 5/5 passed
• pnpm ci:typecheck: passed
• pnpm changeset:validate: passed; no Changeset needed for workflow-only changes
• targeted Biome lint: passed

Local full script tests have 8 unrelated Windows-only failures involving symlink privileges, POSIX execution bits, and path separators. Repository lint also sees the Windows checkout CRLF line endings across the tree; Linux CI remains the authoritative full verification.