fix(ci): preserve existing assets when retrying releases

[owjs3901]

Retrying the 0.3.0 release successfully skipped existing PyPI wheels, but uploading their existing GitHub assets failed with ReleaseAsset: already_exists. This prevented changepacks from finalizing the draft releases after npm trusted publication succeeded.

Use one upload script for npm and Python assets. It reads the existing release asset names, preserves completed nonempty assets, and uploads missing files. Incomplete or empty name collisions fail safely instead of permitting finalization. Missing files and invalid release URLs fail explicitly. Python checks out the repository before invoking the script.

Validation:

• Bash syntax and workflow YAML checks passed; OIDC permissions remain intact.
• Behavior checks passed for a partially uploaded release, a fully uploaded release, literal filenames, failed uploads, missing files, and invalid URLs.
• All five published npm 0.3.0 tarballs passed integrity, dependency, file, and provenance checks. Registry installation runs the CLI as 0.3.0; npm audit signatures verified registry signatures and attestations for the CLI and Windows native package.

Independent review passed after restricting skips to uploaded, nonempty assets. Main CI run 36824414706 succeeded with all 39 executed jobs passing. Both npm and Python skipped existing packages/assets successfully, and changepacks finalized their 0.3.0 releases.