fix(library-publish): a promotion removes any catch-up tag it finds, not only its own

[beplus-agent-claude]

beplus/ai's first stage promotion after #15 caught up 5 versions of each of its 12 packages and stayed green, but left a catch-up dist-tag on all 12, with a warning for each:

not authorized to perform: codeartifact:PutPackageMetadata … because no identity-based policy allows the codeartifact:PutPackageMetadata action

Removing a dist-tag in CodeArtifact needs PutPackageMetadata, and the npm-publishing roles have only PublishPackageVersion, which sets a tag on publish but can't remove it. Granting the permission alone wouldn't clear these 12: a run removed the tag only from the packages it had just caught up on, and the next ai promotion has nothing to catch up.

The change (promote job)

• The CodeArtifact read that lists a package's versions now also returns its dist-tags (npm view <name> versions dist-tags), so it's still one call per package. tagged.txt lists the packages that still carry catch-up.
• The tag is removed from every package caught up now or listed there, so a tag a run couldn't remove (missing permission, cancelled run) goes on the next one.
• The warning names the missing permission.

README updated.

Tested

Not run on GitHub yet. Locally, the steps ran against stubbed npm, set up with the state beplus/ai's run left:

1. Role without the permission: the run stays green and warns for each package, naming PutPackageMetadata.
2. Permission granted: the next run removes every leftover tag, including on packages with nothing to catch up.
3. Nothing left: no dist-tag calls at all.

Before merge

The CodeArtifactPolicy in bepluscloud/monorepo's GitHubOIDCStack.ts gets codeartifact:PutPackageMetadata (being done separately). Without it, this PR changes nothing but the warning.

After merge

• Tag v2.10.1 and move v2 to the merge commit.
• Run workflow on beplus/ai's stage branch. It has nothing to catch up, and removes the 12 leftover tags.

beplus/be#9 got the same fix in scripts/release/catch-up-codeartifact.sh.