Add npm/PyPI package publishing access management (config + drift detection) (#169)

* Add npm/PyPI package publishing access management (config + drift detection)

Declare expected npm org membership, per-package maintainers and trusted
publishers, and PyPI project rosters in src/config/packageAccess.ts, with
npm/pypi identity fields on members in users.ts.

Deliberately outside the Pulumi resource graph: npm governance writes
require an interactive 2FA challenge since August 2026 (read endpoints
still work with a granular access token), and PyPI has no management API
at all. Drift against the live npm registry is detected read-only by
scripts/check-package-drift.ts (weekly via package-drift.yml, no-op when
the NPM_READ_TOKEN secret is absent), which emits a remediation plan of
npm CLI commands for a maintainer to run in one 2FA-approved session.
PyPI procedures are documented as a manual runbook in the README.

* Encode all slashes when escaping package names in registry URLs

Fixes the CodeQL finding: String.replace with a string pattern only
replaces the first occurrence. Use a shared helper with a global regex,
following the npm CLI convention (keep '@' literal, encode every '/').

---------

Co-authored-by: Claude <noreply@anthropic.com>

package.json

@@ -7,6 +7,7 @@
     "build": "tsc",
     "validate": "npx ts-node scripts/validate-config.ts",
     "test": "npx ts-node scripts/test-config.ts",
+    "check-package-drift": "npx ts-node scripts/check-package-drift.ts",
     "check": "npm run format:check && npm run validate && npm run test",
     "format": "prettier --write .",
     "format:check": "prettier --check ."