Make marketplace releases resumable

[Stephen Belanger (Qard)]

Summary

• install pnpm 11.21.0 and Node 24 before building the Codex distribution
• allow an interrupted production release to resume when its existing monorepo tag points to the selected release commit
• reuse an existing monorepo GitHub Release while healing the missing distribution deployment
• continue rejecting version changes or tags that point at a different commit

Root cause

The Codex v1.0.0 release recorded v1.0.0-codex in the monorepo, then failed because the distribution build invokes pnpm but the marketplace release job did not install it. The existing-tag guard would reject a safe retry.

Validation

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/_release.yml
• parsed the workflow with Ruby Psych
• git diff --check

After this lands, rerun the Codex 1.0.0 production release to finish its distribution deploy, target v1.0.0 Release, and smoke test.