fix: use public registry for release installs

[nahiyankhan]

Summary

• Forces the release workflow root and UI installs to use registry.npmjs.org instead of any inherited/internal registry config.
• Normalizes the dev UI package-lock.json resolved tarball URLs from Block Artifactory to npmjs, avoiding the npm ci --prefix src/dev/ui stall that ended with npm's Exit handler never called! error.
• Disables npm audit/funding calls during the release UI install to keep the CI install path focused and deterministic.

Verification

• CI=true pnpm install --frozen-lockfile --registry=https://registry.npmjs.org
• npm ci --prefix src/dev/ui --no-audit --no-fund --registry=https://registry.npmjs.org --replace-registry-host=always
• pnpm build
• pre-push hook: pnpm biome check ., pnpm tsc --noEmit, pnpm vitest run