ci: Move release tag creation after npm publish succeeds (#11627)
## Summary
Fixes the issue where a failed release workflow leaves behind a git tag
that blocks all future release attempts for that version.
**The problem**: The release workflow created the git tag early (during
staging), before smoke tests, builds, and npm publish. If any of those
steps failed, the tag would persist and block retries.
**The solution**:
- Move tag creation to **after** npm publish succeeds
- Use the staging branch as the lock mechanism (prevents concurrent
releases)
- Auto-cleanup the staging branch on failure
- Add `clear-staging-branch` workflow input for manual recovery
### New release flow
```
stage (creates staging branch, NO tag)
→ smoke tests + builds (parallel)
→ npm-publish
→ create-release-tag (only on success)
→ docs alias + PR creation
On failure → cleanup job deletes staging branch
```
### Recovery from stuck state
If cleanup fails and a staging branch is stuck, trigger the workflow
with `clear-staging-branch` enabled. The input has extensive warnings
about when it's safe to use.
### Cleanup performed
Also deleted the stale `v2.8.2-canary.4` tag and
`staging-2.8.2-canary.4` branch that were blocking releases (npm package
was never published).
