[AlexMikhalev]

The browser editor still resolved Terraphim crates through a private registry, and its GitHub release workflow produced candidate artifacts without publishing a qualified release. This change makes the root workspace build from published crates.io dependencies and adds protected prerelease publication that tests and promotes the same immutable artifact bytes.

• Preserve the already published Alternatives/Lab 0.1.1 source trees and the main-owned crate publisher allowlist. Resolve the root and browser crates through public Terraphim releases, including LSP core 1.23.1, with a registry-only lock.
• Enforce public source/lock provenance and a fresh isolated Cargo home. Run native, documentation, Clippy and Wasm checks in public PR CI.
• Build one browser archive, run the existing WASM host tests and real Chrome synonym-sharing/offline checks against it, save actual outputs, and publish through the protected editor-release environment. Publication verifies every uploaded asset and anonymously reads it back; retries reuse the successful qualification artifact ID.

Validation: 502 native tests and 11 doctests passed; cargo fmt, Clippy with warnings denied, and the Wasm workspace check passed. All 82 Python tests and actionlint for the three affected workflows passed. Independent review covered both guard and release-CI packets; the final public lock and two equivalent Clippy expression changes were reviewed separately. Both frozen library trees and all five existing crate-controller files match their approved sources.

The new release workflow has not yet produced an RC. Actual RC qualification runs on its immutable tag; previous RC1 smoke checks exercised the runners only. Qualification explicitly retains the broader 41-requirement and host limitations. The archive continues to exclude the separately pinned host-session bridge, preserving the VS Code importer contract.