Prevent npm alpha dist-tags from moving backward (#49704)

## Why

Publishing an older alpha or alpha hotfix can overwrite npm dist-tags that already point to a newer release.

## What changed

Check each package's current npm dist-tag before publishing an alpha release, using the existing release version comparison and workflow concurrency lock. Handle `alpha` and platform-specific tags independently for Codex, the SDK, and the responses API proxy.

When the release does not advance the current version, publish under `release-<version>-<tag>` to keep it installable without changing the alpha or `latest` tags. Abort publishing if the registry lookup fails.

## Testing

Add unit tests for package and platform tag selection, older releases, dotted alpha hotfixes, missing tags, and registry lookup failures.

GitOrigin-RevId: 9c0edec1149bf78c01aac0f700e963630316eaea

.github/workflows/rust-release.yml

@@ -1778,6 +1778,11 @@ jobs:
       contents: read
 
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
@@ -1898,6 +1903,12 @@ jobs:
                 ;;
             esac
 
+            # The workflow concurrency group holds the lock from this lookup
+            # through publish, including concurrent alpha/hotfix release runs.
+            if [[ "${NPM_TAG}" == "alpha" ]]; then
+              tag="$(python3 .github/scripts/npm_alpha_tag.py "${tarball}" "${VERSION}" "${tag}")"
+            fi
+
             publish_cmd=(npm publish "${GITHUB_WORKSPACE}/${tarball}")
             if [[ -n "${tag}" ]]; then
               publish_cmd+=(--tag "${tag}")