fix(package): make npm authentication explicit

Plan

1. Publish older stable npm releases with a safe release-x.y.z dist-tag instead of failing tag selection.
2. Keep npm trusted publishing opt-in and use NPM_TOKEN for the live @xrow/test merge-request publish.
3. Cover token, OIDC opt-in, merge-request publishing, and generated documentation behavior with focused tests.

Acceptance criteria

• Older stable versions such as 4.210.0 select release-4.210.0 when a newer stable tag exists.
• trusted-publishing is a boolean component input and defaults to false.
• NPM_ID_TOKEN is used only when trusted publishing is explicitly enabled for npmjs.com.
• The merge-request @xrow/test publish uses the masked NPM_TOKEN variable.
• Merge-request remote publishes use commit-scoped versions and dist-tags.
• Component tests, shell syntax checks, generated docs, and GitLab CI lint pass.

Closes #358 (closed)