Honor npm publish access and tag in registry payloads

Problem

pantry publish --npm --access public prints Access: restricted for scoped packages when their manifest does not contain publishConfig.access.

The publish implementation also hardcodes "access": "public" and dist-tags.latest inside the npm registry payload. As a result:

• the CLI option is not the source of truth
• publishConfig.access and publishConfig.tag are only displayed, not applied to the upload
• a custom --tag is not applied to dist-tags
• CLI defaults make it impossible to distinguish an explicit override from a manifest setting

This was observed while releasing @stacksjs/bumpx@0.2.7 from https://github.com/stacksjs/bumpx/actions/runs/29885154087.

Required contract

• explicit --access and --tag override package metadata
• otherwise publishConfig.access and publishConfig.tag are honored
• otherwise scoped packages default to restricted, unscoped packages to public, and the tag defaults to latest
• the resolved values are used both in diagnostics and in the npm registry payload
• tests parse the generated payload and assert its access and dist-tag fields