[GeoffreyBooth]

Two changes to .github/workflows/release.yml:

1. Staged publishing. The final step is now npm stage publish instead of npm publish. CI uploads the version to npm's staging queue, and a maintainer must approve each version with 2FA, using npm stage approve or npmjs.com. The npm trusted publisher is configured stage-only (Allow npm publish unchecked), so a plain npm publish from this workflow would be rejected.
2. Unprefixed tags. The tag check now compares the package.json version to the release tag with no v prefix, matching the repo's tag history (2.6.0, 2.6.1, 2.7.0). The tag is also passed through an env variable instead of being interpolated into the shell command. The release for this version must therefore be tagged 2.7.1, not v2.7.1.

Merge this PR before creating the GitHub Release. A release run uses the workflow file from the tagged commit, so a release created before this merges would run the old npm publish workflow and its v-prefixed tag check.