fix: bundle correct hyperd 0.0.26359 in npm packages

[StefanSteiner]

What & why

The npm packages hyperdb-mcp and hyperdb-api-node bundle a hyperd
engine binary. .github/workflows/npm-build-publish.yml downloads that engine
using its own hardcoded HYPERD_VERSION / HYPERD_BUILD_ID (env) and
per-platform hyperd-sha256 (build matrix) — values that are decoupled from
hyperdb-bootstrap/hyperd-version.toml, the source of truth used by
make download-hyperd and the crates.io publish path.

In v0.7.1, #237 bumped the toml to hyperd 0.0.26359 (r07abb490) — so
crates.io shipped the fixed engine (which contains the macOS-14 JIT
registerEHFrames() deadlock fix) — but this workflow was left at the old
0.0.25080 (r2bfd835b). As a result npm 0.7.1 silently shipped the
pre-fix engine: the fix reached crates.io users but not npm users. (Verified
from the published hyperdb-mcp-darwin-arm64@0.7.1 tarball.)

Changes

1. fix: — bump the 5 hardcoded values in npm-build-publish.yml
   (HYPERD_VERSION, HYPERD_BUILD_ID, and the three built-platform
   hyperd-sha256s: macos-arm64, linux-x86_64, windows-x86_64) to match
   the toml. The commented-out darwin-x64 entry is untouched.
2. ci: — add .github/scripts/verify-npm-hyperd-pin.py, a guard that
   asserts the workflow's pin matches the toml (platform slug is the join key),
   and wire it into verify-hyperd-pin.yml (which now also runs when the npm
   workflow or the script changes, and installs python3-yaml). This turns the
   drift into a hard CI failure instead of a silent wrong-engine publish.

Verification done locally

• Downloaded the exact archive the workflow fetches for
  macos-arm64 (…java-macos-arm64-release-main.0.0.26359.r07abb490.zip,
  HTTP 200). Its sha256 == the toml/workflow macos-arm64 pin
  (434a5e7f…). Extracted lib/hyper/hyperd; strings shows 0.0.26359
  and zero 0.0.25080.
• Guard runs green (exit 0) against this branch; runs red (exit 1, flags all 5
  values) against main's stale workflow — i.e. it would have caught the
  0.7.1 drift.

Release impact

Both commits are fix: / ci: (never feat:), so release-please cuts a
patch (0.7.2). After merge + the release-please PR merge + tag, the
release: published event re-runs npm-build-publish.yml, which now bundles
0.0.26359 into the npm packages.

Post-release check (the step missing in 0.7.1): extract the fresh
hyperdb-mcp-darwin-arm64@0.7.2 tarball and assert the bundled
hyperd --version == 0.0.26359, not just the MCP binary version.