fix(toolcraft): initialize toolcraft-design trusted publishing

[kamilio]

Problem

The manually dispatched Release toolcraft packages workflow failed while publishing toolcraft-design:

• Run: https://github.com/poe-platform/poe-code/actions/runs/27367503769
• Commit: d4ca4047b9938dc9aaa49fd3acddeaffcb5d1c03
• Intended lockstep version: 0.0.32
• toolcraft-schema@0.0.32 published successfully
• toolcraft-design@0.0.32 failed with ENEEDAUTH
• toolcraft, toolcraft-openapi were skipped

toolcraft-design currently returns npm E404, so it has never had the one-time initial publish/trusted-publisher setup described in docs/development/NPM_PUBLISHING.md.

Required fix

1. Perform the one-time initial public publish for toolcraft-design.
2. Configure npm trusted publishing for repository poe-platform/poe-code and workflow release-toolcraft.yml.
3. Rerun release-toolcraft.yml.
4. Confirm all four packages publish at one lockstep version.

Do not bypass the workflow with an ad hoc release of the remaining packages; the current state is already partial because toolcraft-schema@0.0.32 exists.

[kamilio]

Repository-side fix is complete and pushed in 84cace20: toolcraft-design is public, included in lockstep version calculation/preparation, built, standalone-verified, and published before the dependent packages. Local metadata/workflow checks passed, the full suite passed (12,603 tests), and workflow run 27441292206 reached the new Publish toolcraft-design step after successfully publishing toolcraft-schema@0.0.35.

The remaining blocker is the one-time npm owner action described in this issue: toolcraft-design still has no npm package, so trusted publishing cannot authorize its first publish. This environment has no authenticated npm session (npm whoami returns E401) and no available authenticated browser session. An npm owner must:

1. Perform the initial public publish of toolcraft-design.
2. Add trusted publisher poe-platform/poe-code, workflow release-toolcraft.yml, no environment.
3. Rerun workflow 27441292206 (or dispatch Release toolcraft packages).

After that run publishes all four packages at one version, this issue can be closed.

[kamilio]

Resolved with the corrected package architecture in e4358273: toolcraft-design remains a private workspace package, is bundled into the published toolcraft package, and is publicly accessible through toolcraft/design. It is not independently published and therefore does not require npm trusted-publisher initialization.

Validation:

• Full suite passed: 12,603 tests.
• Standalone packed-package smoke test successfully imports toolcraft/design.
• Release workflow 27442804266 succeeded and published toolcraft, toolcraft-schema, and toolcraft-openapi at 0.0.36.
• A clean registry install of toolcraft@0.0.36 successfully imported toolcraft/design and exposed 73 symbols.
• Stable release workflow 27442804244 also succeeded.

Closing as released.