Honor npm publish access and tag in registry payloads

Problem

pantry publish --npm --access public prints Access: restricted for scoped packages when their manifest does not contain publishConfig.access.

The publish implementation also hardcodes "access": "public" and dist-tags.latest inside the npm registry payload. As a result:

• the CLI option is not the source of truth
• publishConfig.access and publishConfig.tag are only displayed, not applied to the upload
• a custom --tag is not applied to dist-tags
• CLI defaults make it impossible to distinguish an explicit override from a manifest setting

This was observed while releasing @stacksjs/bumpx@0.2.7 from https://github.com/stacksjs/bumpx/actions/runs/29885154087.

Required contract

• explicit --access and --tag override package metadata
• otherwise publishConfig.access and publishConfig.tag are honored
• otherwise scoped packages default to restricted, unscoped packages to public, and the tag defaults to latest
• the resolved values are used both in diagnostics and in the npm registry payload
• tests parse the generated payload and assert its access and dist-tag fields

Implemented on main in 7e7910d. Pantry now resolves access and tag with CLI > publishConfig > npm defaults, validates both settings, and serializes them into the registry payload. Unit coverage includes precedence and payload behavior. Keeping this open until the next patch release is published and verified.

Implemented in 7e7910d with payload-level coverage, then documented in 60e9a85 and 7d088dd. CLI values now override publishConfig, manifest values override npm defaults, and the resolved access and dist-tag are used in both diagnostics and the npm payload. Released in v0.10.42 and retained in v0.10.43. Pantry CI run 29887331918 is green, and the source-pinned contract is published by stacksjs/white-paper at docs/reference/package-manager.md.

Release clarification: v0.10.42 contains the source commit, but its binary Releaser was superseded before asset publication. The first complete GitHub and npm release carrying this fix is v0.10.43, produced by successful Releaser run 29887332086.