fix(release): use current registry verifier

[JimmyDaddy]

Summary

• keep build and publish inputs pinned to the immutable release tag
• sparse-checkout the fresh-consumer verifier from the protected release branch
• allow already-published tags to benefit from release verification fixes without moving tags

Verification

• npm run verify:actions
• npm run test:ci-guards
• npm run test:release-routing
• actionlint .github/workflows/npm-publish.yml
• git diff --check