fix(release): make registry publishing re-runnable and independent

[adhikjoshi]

The v0.1.2 release published five of six npm platform packages, tripped npm's spam heuristic on the sixth, and took PyPI down with it.

GitHub release ✅ 11 assets
Homebrew cask ✅ 0.1.2
npm platform ⚠️ 5/6 — win32-x64 got 403 "Package name triggered spam detection"
npm entry ❌ never reached
PyPI ❌ step never ran

Nothing was user-visible-broken: the entry package never published, so nobody could install a half-resolved tree. That is the platform-first ordering doing its job.

Three faults, all in the wiring rather than the packages:

1. npm spam detection. Six similarly-named packages published back to back tripped it on the sixth. It's rate-shaped, not permanent — publishes are now paced and that specific 403 is retried with backoff.

2. A retry could not recover. npm refuses to republish an existing version, so re-running would have failed on the five that succeeded and never reached the sixth. Already-published versions are now skipped, which makes re-running the release job the correct recovery for a partial publish.

3. PyPI was hostage to npm. They're independent registries. The upload now runs with if: always() and --skip-existing.

Also fixes a repeat of an earlier mistake of mine: secrets is not an available context in a step-level if, so the guard reads the mapped env var.

Verified against the live registry

modelslab-cli-darwin-x64 YES -> skip
modelslab-cli-linux-x64 YES -> skip
modelslab-cli-win32-arm64 YES -> skip
modelslab-cli-win32-x64 NO -> publish
modelslab-cli NO -> publish
403 spam detection -> retry
429 Too Many Requests -> retry
cannot publish over ... -> skip (already there)
402 payment required -> fatal

It identifies exactly the two packages v0.1.2 left unpublished.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}