fix: verify tevm-test release readiness

[roninjin10]

What changed

• makes the release job lint, typecheck, build, and test before Changesets can publish
• keeps release builds single-pass while preserving npm provenance and public package publish configuration
• forwards the optional Optimism RPC fixture secret in CI and release jobs
• upgrades Vocs from 2.7.0 to the current 2.7.2 and removes the Biome 2 deprecated rules syntax
• awaits the test-node fork initialization so asynchronous startup failures can no longer race process shutdown and produce a false green suite
• supplies a mock KZG implementation for the cached EIP-4844 fork fixture

Verification run locally

• pnpm install --frozen-lockfile: passed from a fresh clone (1,069 packages)
• pnpm lint: passed, 177 files checked
• pnpm typecheck: passed in all five projects
• pnpm build: passed; all three packages emitted ESM, CJS, and declaration output; Vocs 2.7.2 generated 35 static files
• actionlint .github/workflows/*.yml: passed
• npm pack --dry-run --json: passed for @tevm/test-matchers, @tevm/test-node, and @tevm/test-utils
• every external @tevm/* dependency at 1.0.0-rc.151 was confirmed on npm and uses a caret range; the only workspace:^ dependency is the private intra-repository matcher integration package
• pnpm --filter @tevm/test-matchers-integration test: 11 files passed; 229 tests passed, 11 skipped; no type errors
• root pnpm test: failed. @tevm/test-utils passed 5/5 and @tevm/test-matchers passed 89/89. @tevm/test-node reported 28 failed files, 23 passed files, 6 skipped files, 200 passed tests, 44 skipped tests, 7 todo tests, and 56 startup errors.

Known release blocker

The cached mainnet block contains EIP-4844 transactions. Published @tevm/common@1.0.0-rc.151 loses customCrypto.kzg after nested Common.copy() calls. @tevm/node performs those nested copies during fork initialization, so client.tevmReady() fails with:

InternalError: A common object with customCrypto.kzg initialized required to instantiate a 4844 blob tx

A direct reproduction confirmed the original common and its first copy retain KZG, while the second wrapper copy does not. This must be fixed and published from the core evmts/tevm repository, then consumed here with a caret range. This PR intentionally makes that real startup failure block CI and publishing instead of leaving a timing-dependent false green.

Human configuration still required

• configure NPM_TOKEN with publish rights for the three @tevm/test-* packages, or explicitly migrate the workflow to npm trusted publishing
• create/link a Vercel project rooted at docs, bind test.tevm.sh, and add VERCEL_TOKEN, VERCEL_ORG_ID, and VERCEL_PROJECT_ID to the docs environment; the current environment has no secrets and the domain returns DEPLOYMENT_NOT_FOUND
• add TEVM_RPC_URLS_OPTIMISM if the optional live RPC fixture must execute in CI; the workflow now consumes it