feat(library-publish): stage and prod catch up on every version dev released before

[beplus-agent-claude]

Release on dev three times, promote once, and stage and prod got only the third. The promote job published only the versions the promoted commit carries, but a fast-forward promotes the commits in between too, so an app whose lockfile pinned one of the skipped versions on dev could not install it on stage or prod.

The change (promote job)

• Every earlier version dev released, too. For each package Rush publishes, every version GitHub Packages has that is lower (by semver) than the commit's own, and that this environment's CodeArtifact lacks, is fetched and published byte for byte. dev's newer releases wait for their own promotion.
• latest never moves back. The earlier versions go out first, oldest first, under a temporary catch-up dist-tag that is removed afterwards. Only the commit's own version becomes latest.
• A refused earlier version is a warning, not a failed run (one archived there on purpose, say), and the next promotion tries it again. The commit's own version failing still fails the run, as before, but only after every other package has had its turn.
• prod: the caught-up versions' GitHub releases become full releases with --latest=false, and "Latest" is decided among the commit's own versions, as before. One gh release list finds the pre-releases.
• The job summary lists what was published.

AWS auth now comes before the GitHub Packages read, because the job has to know what the CodeArtifact has before it knows what to fetch.

README updated.

Tested

Not run on GitHub yet. Locally, the new steps ran against stubbed npm and gh:

• a gap, with dev ahead of the promoted commit
• a prerelease line, where next.10 must come after next.3
• a package already in sync
• a refused earlier version, and a refused version of the commit itself
• a re-run
• a version dev never released
• a registry error that isn't a 404

Companions

• 25 library callers triggered only on dev, so fast-forwarding stage or prod never ran this job for them. Each now also triggers on stage and prod, as beplus/analytics already did: beplus/ai#22, beplus/api#4, beplus/auth#23, beplus/aws#6, beplus/billing#3, beplus/cdk#9, beplus/cms#45, beplus/config#6, beplus/data#15, beplus/database#9, beplus/docs#27, beplus/events#3, beplus/messaging#3, beplus/metering#3, beplus/mobile#4, beplus/npm#3, beplus/provisioning#3, beplus/pulse#3, beplus/rush#6, beplus/saas#12, beplus/schema#3, beplus/server#4, beplus/sync#3, beplus/uix#117, beplus/web#4.
• ci(release): stage and prod catch up on every version dev released before be#9 does the same catch-up in its own release.yml.

After merge

• Move v2 to the merge commit.
• Promote each library once (a fast-forward, or Run workflow on stage/prod). The first run catches each registry up.