ci(npm-publish): fail closed on prerelease-hint versions + consolidate unpublished changelog entries

[John-David Dalton (jdalton)]

The v1.x publish flow had two gaps: a real dispatch would publish whatever version the tree carried (including a not-yet-released bump state), and the release cut used the single-call create that immutable releases can race.

Workflow (.github/workflows/npm-publish.yml)

• A real publish (dry-run: false) now fails while package.json carries a X.Y.Z-prerelease hint, so a dispatch on an un-bumped tree can never reach the registry.
• The GitHub release is cut as a draft and flipped live with --draft=false --latest=false (3-step immutable-release pattern, notes only). --latest=false keeps v1.x maintenance releases from taking the repo Latest badge once 2.x ships from main.
• The environment comments now state the current npm-publish deployment-branch policy (main + v1.x).

Release state

• Versions 1.1.148-1.1.150 never reached npm, so their changelog entries fold into one ## [Unreleased] section: the latest Coana CLI 15.9.7, the socket scan view cached-results read from the sdk 4.x bump (feat(sdk): bump socket-cli v1.x to @socketsecurity/sdk 4.x (SURF-1446 + SURF-742) #1427), and the socket fix discovery fixes (fix(fix): propagate Coana discovery failures + consume structured discovery result #1444). We ship forward, no backfill of the skipped versions.
• package.json moves to 1.1.150-prerelease, the committed hint the release bump consumes: strip the hint, promote [Unreleased] under the released heading, then dispatch the publish.

---

Note

Medium Risk
Changes npm publish guards and GitHub release cutting on the release pipeline; fail-closed prerelease checks reduce accidental registry publishes rather than increasing exposure.

Overview
Hardens the v1.x npm publish workflow and resets release metadata so the next ship is a single forward release (no backfill of skipped 1.1.148–1.1.150).

Workflow (npm-publish.yml) — On a real publish (dry-run: false), the job now stops if package.json still has a X.Y.Z-prerelease hint, so an un-bumped tree cannot reach npm. GitHub releases use draft → publish (--draft=false --latest=false) for immutable-release safety and so v1.x does not take the repo Latest badge from 2.x on main. Comments are updated for the npm-publish environment / trusted-publisher pairing and for all three packages hard-failing before tag/release.

Release state — Changelog drops the unreleased 1.1.148–1.1.150 headings and folds those notes into [Unreleased] (Coana 15.9.7, socket scan view cached results, socket fix discovery/error handling). package.json is set to 1.1.150-prerelease as the committed next-version hint for the normal bump-then-dispatch flow.

^{Reviewed by Cursor Bugbot for commit c7086e8. Configure here.}