fix(release): use npm semver for cohort checks

[drewstone]

Summary

• use the maintained semver library for package cohort admission checks
• reject prerelease versions unless the range explicitly names them
• remove handwritten numeric version arithmetic and cover prerelease and large-component cases

Evidence

• focused cohort tests: 26/26 pass
• pnpm run lint: pass
• pnpm run typecheck: pass
• pnpm run build: pass
• pnpm run verify:package: pass
• git diff --check: pass

This is dev-only release verification; Runtime execution behavior is unchanged.

[drewstone]

Closing: this release-check cleanup introduced a semver dev-dependency unavailable in the packed-cohort job. The underlying prerelease arithmetic issue is real, but it needs a separately designed dependency/workflow change; do not merge this scope into the current research delivery.