feat(js-bazel): make npmjs publish policy explicit

[Jess Sullivan (Jesssullivan)]

Summary

• add npm_publish_mode=required|optional|disabled to js-bazel-package.yml
• keep required as the default for backwards compatibility
• let Bazel-first packages disable or best-effort npmjs while GitHub Packages remains independent
• document the policy and update the hosted example for tinyland-auth-redis-style packages

Validation

• actionlint .github/workflows/js-bazel-package.yml
• python3 scripts/validate-ci-templates.py internal-refs
• nix develop --command python3 scripts/validate-ci-templates.py manifest
• git diff --check

Repo-wide actionlint still reports pre-existing custom runner label warnings outside js-bazel-package.yml.