fix: harden npm publish and local LaunchAgent deployment

[pitimon]

Goal

Harden the two release paths exposed during the 0.39.49 incident.

Problems

1. The npm workflow had no repository NPM_TOKEN, so automated publication failed and required a manual fallback.
2. The workflow does not fresh-install and semantically inspect the exact registry artifact after publication.
3. scripts/release.sh assumes two literal package pins and parses only split XML --port arguments. The installed LaunchAgents use one TOKENTRACKER_NPM_PACKAGE environment pin and a shell-wrapper command containing --port 17680, so the helper rejects a valid plist and can report the wrong port.

Acceptance criteria

• Repository NPM_TOKEN is configured without exposing its value.
• Publish workflow fresh-installs the exact package version and runs harmless CLI + embedded-dashboard-version checks after publish or existing-version reconciliation.
• Registry propagation uses bounded retries and fails closed.
• release.sh supports current one-pin environment-variable layout and legacy literal layouts.
• Port parsing supports split arguments, --port N, and --port=N inside shell-wrapper strings.
• Backups are unique per deployment attempt.
• Deterministic tests reproduce old failures and pass after the fixes.
• Full local and hosted CI pass.