This PR was squashed before being merged into the 2.x branch.

Discussion
----------

[CI] Harden the release-on-npm workflow

| Q              | A
| -------------- | ---
| Bug fix?       | no
| New feature?   | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations?  | no <!-- if yes, also update UPGRADE-*.md and src/**/CHANGELOG.md -->
| Documentation? | no <!-- required for new features, or documentation updates -->
| Issues         | Fix #... <!-- prefix each issue number with "Fix #", no need to create an issue if none exist, explain below instead -->
| License        | MIT

Following #3604

## Summary

Following an audit of `.github/workflows/release-on-npm.yaml` with my super friend Claude,
this PR tightens several aspects of the npm release pipeline.
OIDC trusted publisher protects authentication on the npm side, but says nothing about the integrity of the code being published.
The changes below close that gap.

Each commit addresses one finding from the audit, tagged `(F<n>)` in its title.

## Commits

- **[CI] Publish from the tagged commit, not the branch HEAD (F1)** — checkout `${{ github.ref }}` (the tag) instead
of the hardcoded `2.x` branch, and verify the tagged commit is an ancestor of the matching release branch
(`2.x` for `v2.*.*`, `3.x` for `v3.*.*`). Closes a TOCTOU where `2.x` HEAD could drift between tag creation and job execution.

- **[CI] Stop touching package.json versions during release (F8)** — drop the `pnpm version` + commit + push back to
`2.x` block. The Git tag is the single source of truth; version bumps are now done manually before tagging. The workflow token is downgraded from `contents: write` to `contents: read`, and **the new `MAINTAINERS.md` documents the bump procedure.**
Code can not be commited/pushed to the repo anymore ✨

- **[CI] Pin npm version used by the release workflow (F6)** — replace `npm@latest` with `npm@11.16.0` so a compromised npm release cannot ship through the release path without an explicit, reviewable bump PR.

- **[CI] Generate npm provenance attestations on publish (F7)** — add `--provenance` to `pnpm publish`. Each tarball now carries a signed SLSA attestation pointing to the repo, commit and workflow run, verifiable via `npm audit signatures`.

- **[CI] Serialize release runs per tag (F9)** — add a concurrency group keyed on `github.ref_name`, so two runs on the same tag queue instead of overlapping. Distinct tags (`v2.x.y` vs `v3.0.0`) still run in parallel.

- **[CI] Build assets and refuse to publish if dist files drift (F2)** — run `pnpm build` on the tagged commit and fail if `git diff --quiet` reports anything. Mirrors the existing `dist-files-unbuilt.yaml` PR check, brought into the release path so tampered dist/source pairs cannot publish even if the branch CI was bypassed.

Commits
-------

6607915 [CI] Build assets and refuse to publish if dist files drift (F2)
aa5fcb8 [CI] Serialize release runs per tag (F9)
49d7697 [CI] Generate npm provenance attestations on publish (F7)
b61c0d5 [CI] Pin npm version used by the release workflow (F6)
86131fe [CI] Stop touching package.json versions during release (F8)
4ab4f5b [CI] Publish from the tagged commit, not the branch HEAD (F1)