fix(ci): advance @next dist-tag on stable publish

Regression: after a stable release, npm publish --tag latest correctly
advances latest, but @next stays pinned to whichever pre-release we cut
last. Consumers tracking `aiwg@next` resolve to stale code (e.g. after
2026.5.3 GA, @next still pointed at 2026.5.3-rc.1).

Add a post-publish step that runs `npm dist-tag add aiwg@$VERSION next`
when the release is stable. Step is gated on `steps.version.outputs.prerelease == 'false'`
so pre-releases (which legitimately update @next via --tag next) are
unaffected. Reuses the workflow's OIDC token — no long-lived auth.

Verified locally:
  before: latest=2026.5.3  next=2026.5.3-rc.1
  after:  latest=2026.5.3  next=2026.5.3  (target state)

Force-retag v2026.5.3 to run the workflow with the new step. The publish
step's idempotency (already-published path) handles the re-fire cleanly;
only the new dist-tag step actually performs work on this run.

Refs: #1278 (post-Track A regression)

Author: jmagly

.github/workflows/npm-publish.yml

@@ -349,6 +349,31 @@ jobs:
             fi
           done
 
+      - name: Advance @next dist-tag on stable releases
+        # On a stable publish (--tag latest), @next is still pointing at
+        # whatever pre-release we cut last. Consumers tracking `aiwg@next`
+        # would resolve to stale code. After a stable lands, advance @next
+        # to point at the same stable version so the channel never lags.
+        #
+        # Idempotent — `npm dist-tag add` is a no-op if @next already
+        # points at the target. Uses the same OIDC-issued auth as the
+        # publish step above (npm 11.5+ honors the workflow's id-token
+        # claim for dist-tag operations).
+        if: steps.version.outputs.prerelease == 'false'
+        run: |
+          set -o pipefail
+          VERSION='${{ steps.version.outputs.version }}'
+          echo "Advancing aiwg@next → ${VERSION}"
+          npm dist-tag add "aiwg@${VERSION}" next
+          # Verify
+          CURRENT_NEXT=$(npm view "aiwg@next" version 2>/dev/null || echo "")
+          if [ "$CURRENT_NEXT" = "$VERSION" ]; then
+            echo "✓ aiwg@next = ${VERSION}"
+          else
+            echo "✗ aiwg@next = ${CURRENT_NEXT:-<missing>}, expected ${VERSION}"
+            exit 1
+          fi
+
       # ============================================================
       # Tarball Sigstore signing — #1287 / A8 (Wave 5 of #1278)
       # ============================================================