fix(release): simplify beta publishing

[benlesh]

What changed

• replace the GitHub App, OIDC, qualification, private-staging, and finalization workflow chain with one local interactive command: pnpm release:beta <version>
• retain the useful repository, package, browser, security, and conformance checks
• validate, build, pack, and dry-run all four release packages before publishing
• publish the packages in dependency order, with rxjs last, using the maintainer's npm authentication and 2FA
• update the release runbook, architecture, decision record, security documentation, and active project plan

Why

The previous release design added substantial administrative and operational complexity without a proportionate security or usability benefit for the current maintainer model. This restores a small, inspectable release path while retaining deterministic package validation and making npm's interactive authentication the publication boundary.

Impact

After this merges, the first beta can be released from a clean, current master checkout with:

pnpm release:beta 9.0.0-beta.0

The command refuses CI, token-based noninteractive publication, dirty checkouts, divergent master checkouts, invalid beta versions, and unsynchronized package manifests. It supports safe resumption only when an already-published package has identical integrity.

No RxJS runtime API, export, type, package-format, or website behavior changes.

Verification

• pnpm run release:check — 37 checks passed
• all four package test:package gates passed
• workflow formatting passed
• full pnpm release:beta 9.0.0-beta.0 --dry-run rehearsal passed
• npm simulated publication of all four exact tarballs and confirmed nothing was published
• final checkout remained clean