ci: gate npm publication on browser-compatible imports (#2500)

## Summary
- add a release-only, read-only browser-compatibility job between
immutable release validation and protected npm publication
- build and `npm pack` the exact verified release commit, then link the
packed native-browser ESM graph and reject browser-unresolvable package
specifiers or imports outside the artifact
- preserve SHA-pinned actions, frozen dependency installation, protected
release/publish environments, immutable commit binding, and OIDC-only
npm publishing

## Dependency and rollout
- follow-up to #2494; the production fix is independently tracked in
#2495 and is intentionally not included here
- the current `main` artifact correctly fails this guard on
`#x509-transport-state`; merge #2495 before activating this fail-closed
publication gate
- a temporary, local-only simulation of the production fix successfully
linked all 173 packed SDK modules

## Verification
- `pnpm build`
- `pnpm lint`
- `pnpm exec tsc --noEmit`
- `node --experimental-strip-types scripts/check-node-version-policy.ts`
- executed the exact workflow scripts against the current packed
artifact (expected failure on `#x509-transport-state`) and a temporary
repaired artifact (173 modules linked)
- checked valid relative imports, rejected bare/private specifiers and
package-root escapes, and asserted workflow ordering, immutable SHA
binding, action pinning, least privilege, protected environments, and
OIDC isolation
- two consecutive clean adversarial-review rounds with two independent
fresh-context, read-only reviewers per round