fix: publish fallback package when npm is blocked

[KryptosAI]

Summary

• Keep the existing npm token and Trusted Publishing release paths unchanged.
• When both npm auth paths are unavailable, pack a distinct fallback version like 0.20.3-github.<run>.
• Upload the tarball as an Actions artifact and publish it as a GitHub prerelease asset with a direct install command.

Validation

• Parsed .github/workflows/release.yml with Ruby YAML loader.

[github-actions]

🔭 MCP Observatory — All clear ✅

All checks passed. No security issues, no schema quality warnings.

📊 Summary

Gate: fail · 0 tools · 0 prompts · 0 resources

---

_{🔭 MCP Observatory — test your MCP servers for breaking changes · ⭐ Star}