ci(release): add rebase step before versioning to prevent push race

[charlesmulder]

Description

Added rebase steps and deferred npm publish in release action to prevent push failures and orphaned npm versions.

Problem 1 - Push failures: Release jobs check out github.sha (triggering commit), not main tip. When a PR merges to main while a release job is running, git push --follow-tags fails with non-fast-forward error.

Problem 2 - Tag resolution: verify-versions.sh and nx release use git tag --merged HEAD to resolve current version. Stale checkout can't see tags from prior queued releases → false mismatches.

Problem 3 - Orphaned npm versions: nx release --yes publishes to npm before git push. If push fails, npm has new versions but git doesn't → manual recovery required.

Solution:

1. Rebase before verify-versions (fast-forward, brings in latest tags so --merged HEAD sees them)
2. nx release --skip-publish (defer npm publish)
3. Rebase before push (replays version commit if main moved during release)
4. nx release publish (only after push succeeds)

Already present: Concurrency group with cancel-in-progress: false serializes release jobs.

---

CI validation: Merge and observe next automated release. Check that:

• Release job completes successfully
• Version commits/tags pushed to main
• Packages published to npm registry
• No "non-fast-forward" errors in logs
• No orphaned npm versions if push fails

---

Anything reviewers should know?

• Two rebase calls: first is always fast-forward (no local commits), second replays only the version commit
• --skip-publish prevents publish in main nx release invocation; standalone nx release publish handles publish after push
• If push fails (edge case: commit lands between rebase and push), re-running is safe — no npm versions published yet
• Comments explain why each rebase is needed

---

Checklist

• Tests: N/A (CI infrastructure change, validated by workflow execution)
• API: N/A (no API changes)
• Migrations: N/A (no schema changes)
• Dependencies: N/A (no dependency changes)
• Security: N/A (read-only git operations in trusted CI context)

AI disclosure

Assisted by: Claude Code

[catastrophe-brandon]

I'm wondering what happens if $npm_ver is "NOT_ON_NPM" here? Do we need another elif?