Add trusted publishing OIDC preflight checks in release workflow

[danbot315]

Add a preflight step before publish to validate npm trusted publisher/OIDC readiness.

Scope

• verify OIDC token can be requested in workflow context
• validate publish target package names are configured for trusted publisher
• fail fast with actionable errors

Acceptance Criteria

• release job fails before publish when trusted publisher mapping is missing
• error output points to exact package/workflow mapping to fix