feat(npm): add publish-flow error codes and messages (S11 Step 14, part 1/3)

📦 Stacked MRs

This change is split into 3 stacked merge requests to keep each part within the team's review size limits (~600 LoC ideal). Each part targets the previous one (part 1 targets main). Please review and merge them in order, bottom-up — merging part 1 auto-retargets the rest.

Stack (review/merge bottom-up)

• feat(npm): add publish-flow error codes and mes... (!642 - merged) • David Fernandez • 19.2 👈
• feat(npm): add publish parse + envelope validat... (!643 - merged) • David Fernandez • 19.2
• test(npm): add publish parse/precheck integrati... (!644 - merged) • David Fernandez • 19.2

📌 This part

Part 1 of 3 of npm hosted — Step 14: publish handler parse, envelope validate, pre-check.

Adds the publish-flow Code and SafeMessage constants the npm publish handler returns, mirroring the S11 Error Cases table one-to-one, plus the TestErrorCodes rows that pin each code string. No handler logic yet (part 2) and no integration suite yet (part 3) — this is the foundational error-code surface they build on.

🔗 References

• Plan: docs/plans/2026-05-11-npm-hosted.md — Step 14
• Spec: docs/specs/S11-npm-hosted.md

Related to #132 (closed)