fix(ng-dev/release): harden release publish npm config isolation, tag verification, and child process sanitization

[josephperrott]

Summary

• Isolate npm publish working directory (github-actions/release/publish, ng-dev/release/versioning): Execute NpmCommand.checkVersionExists, NpmCommand.publish, and NpmCommand.deprecate during CI release publishing with cwd set to the isolated temporary directory containing the Wombat .npmrc, and resolve tarball paths so any repository-level .npmrc in the workspace cannot override NPM_CONFIG_USERCONFIG.
• Verify existing tag & release commit SHA on HTTP 422 (github-actions/release/publish): When git.createRef or repos.createRelease returns HTTP 422 (already exists), fetch the existing tag reference via git.getRef and verify its commit SHA matches expectedSha before marking it SKIPPED. If the SHA mismatches or verification fails, mark it FAILED and skip package publishing.
• Harden pnpm install during release preparation (ng-dev/release/publish): Pass --ignore-scripts and --ignore-pnpmfile in ExternalCommands.invokePnpmInstall so lifecycle scripts and .pnpmfile.cjs hooks cannot execute while release credentials are active.
• Sanitize rejected logOutput in silent mode (ng-dev/utils): Pass logOutput through sanitize() when rejecting a failed child process in mode: "silent" so URL credentials are redacted consistently.

[gemini-code-assist]

Code Review

This pull request enhances the release publishing workflow by verifying that existing Git tags or releases match the expected SHA on HTTP 422 errors, isolating NPM commands within a temporary directory, and adding safety flags to pnpm install. It also ensures that rejected log outputs are sanitized in silent mode to prevent token leaks. Feedback on these changes suggests resolving the commit SHA for annotated tags during verification to prevent false mismatches, and rejecting failed child processes with a proper Error object instead of undefined to avoid anti-patterns.