ops(release): bootstrap @the-open-engine/zeroshot-rust on npm

[tomdps]

Failure

The exact-main release for fbb4cb292f39692662dd0acf0e4737fab87d7880 partially published v6.25.1, then failed in the rust-publish job:

• Run: https://github.com/the-open-engine/zeroshot/actions/runs/30779104875
• Job: https://github.com/the-open-engine/zeroshot/actions/runs/30779104875/job/91581258755
• @the-open-engine/zeroshot@6.25.1: published
• GitHub Release v6.25.1: published with all five native archives and SHA256SUMS
• @the-open-engine/zeroshot-rust@6.25.1: absent; registry returns 404

The publish step ran from the configured release.yml / release OIDC context and failed with E404 on the first PUT.

Root cause

npm trusted-publisher exchange is package-specific. @the-open-engine/zeroshot already has a trusted publisher, but the new @the-open-engine/zeroshot-rust package does not exist yet and therefore has no package settings in which to configure one. npm currently cannot bootstrap a first package publish through OIDC; npm/documentation#1926 records the same limitation and required manual first publish. The repository and release environment expose no Actions secret that can perform the bootstrap.

Required one-time operator action

1. From immutable tag v6.25.1, stage npm/zeroshot-rust/package.json to version 6.25.1 (npm version 6.25.1 --no-git-tag-version) and publish that exact public package as an npm maintainer.
2. Configure its npm trusted publisher for organization the-open-engine, repository zeroshot, workflow release.yml, environment release, with npm publish allowed.
3. Re-run failed jobs in run 30779104875. The idempotent job will verify the now-existing 6.25.1 package and turn the exact-main release green.

Do not delete/recreate the tag, overwrite the GitHub Release, or publish a different shim version; repository recovery is intentionally immutable and idempotent.