feat(ci): add posthog-js release recovery (#4553)

* feat(ci): add posthog-js release recovery

* fix(ci): avoid workflow summary injection

* fix(ci): harden release recovery finalization

* feat(ci): add explicit S3-only recovery mode

* fix(ci): require approval for recovered npm publish

* fix(ci): harden S3 recovery authorization