ci: run package lane on repo-owned runner

[Jess Sullivan (Jesssullivan)]

Summary

• switch CI and release package workflows from hosted to repo_owned runner mode
• use the repo-level PRIMARY_LINUX_RUNNER_LABELS_JSON Actions variable for explicit Tinyland capability labels
• keep npm_publish_mode disabled and GitHub Packages as the active publish surface

Validation

• git diff --check
• actionlint .github/workflows/ci.yml .github/workflows/publish.yml
• rg verified runner_mode, runner_labels_json, npm_publish_mode, and no NPM_TOKEN workflow reference
• repo Actions variable PRIMARY_LINUX_RUNNER_LABELS_JSON is present and resolves to ["tinyland-nix"]

Linear

• TIN-89