Avoid duplicate GitHub releases after publishing

[kvz]

Why

The #502 release successfully published all seven packages and created their GitHub releases, but the action then failed trying to create the stable releases a second time. Both changeset publish and the added changeset tag pass announced those tags; changesets/action consumes each announcement.

Change

• Use Changesets' supported publish --no-git-tag, followed by one tag pass. That pass also includes Viewer, already published separately under alpha.
• Cover this regression red-first and retain fail-closed behavior when either publication step fails.
• Record the actual release receipts and correct the advice about removing npm's automatic latest tag: the registry returns HTTP 400, as also reported in npmjs doesn't allow removing "latest" tag? npm/cli#8490. Viewer remains explicitly alpha in its README, description and GitHub prerelease.

No package versions or published runtime bytes change. Do not delete valid releases or republish existing versions to recover this run.

Verification

• Publisher test fails without --no-git-tag, then all eight pass with the fix.
• yarn check and yarn verify:full pass.
• Council reports no findings; its Claude leg is unavailable due to the monthly spend limit.
• All seven released registry versions independently verified; the six CI-published stable packages have provenance.
• Content #6047 installs Viewer 0.0.1, Utils 4.9.0, Node 4.13.0 and Types 4.4.1 from npm; its local 13,502 tests pass.

After merging, verify main's release workflow completes without republishing existing versions. API2 deployment remains with Kevin/deployer; Uppy is untouched.

#502
https://github.com/transloadit/content/pull/6047

[kvz]

Merged as 72e4cef after all PR checks passed. Main CI 35648454541 and Release 35648454092 both pass. The release log confirms every existing npm version was skipped; no version was republished and no duplicate GitHub release was attempted. Viewer trusted publishing is now configured for transloadit/node-sdk → release.yml, approved by the maintainer. Viewer remains explicitly alpha: 0.0.1, alpha npm tag and GitHub prerelease. npm also retains latest after refusing its removal with HTTP 400; this limitation is documented, not hidden. Registry-installed Content adoption continues in https://github.com/transloadit/content/pull/6047.