publish-registry validation fails when new packages are out but we won't publish them for a week

To avoid excessive publishing, publish-registry only publishes if it's been a week since the last publish. Unfortunately it then asserts that the registry on npm is exactly what we have locally, which it won't be if new packages have been added. Instead we should always validate that the one on npm is a subset of the local one.