🔒 finalize stable release hardening

[IsaacInsoll]

Summary

• keep degenerate justified rows finite when natural widths round to zero
• remove the one-off npm token bootstrap path and enforce the permanent stage-only release flow
• keep next as the newest release channel and verify both latest and next before stable announcements
• coordinate Testing Library major updates and document string caption tooltips

Verification

• npm run release:check on Node 24.18.0 / npm 12.0.2
• 77 Vitest tests
• all 12 declaration-consumer combinations
• packed consumer, publint, ATTW
• 23 Playwright tests
• root and packed-consumer audits: 0 vulnerabilities
• release and Dependabot YAML parsed successfully

Repository branch protection was also updated to require the Node.js 22 and Node.js 26 compatibility checks alongside the existing required checks.