Publish do-sync from Pulumi - #13609

What changed

• restores the Bazel npm package and tarball pipeline for do-sync
• uses API Extractor plus a single .fix release classifier for major, minor, and patch bumps
• makes Renovate npm updates run the standard post-upgrade fixer
• publishes the deterministic Bazel tarball from the production Pulumi deployment
• replaces the legacy Copybara-based do-sync deployment
• switches npm publishing to the submit.yml GitHub OIDC trusted publisher with provenance
• retires the legacy GCP npm-token secret by revoking workflow access and disabling its deletion protections

Behavior

Release classification is prioritized: public API changes bump major, dependency-manifest changes bump minor, and other package-content changes bump patch. Only one component is bumped per change. Publishing is idempotent and skips a version already present in npm.

The legacy GCP secret requires a second deployment to delete fully: this PR first removes both Pulumi and GCP deletion protection so production deployment remains safe.

Validation

• Gazelle run across affected packages
• scoped Bazel lint and TypeScript tests
• release-classifier unit tests
• do-sync npm package lock test
• Pulumi typecheck and smoke test
• npm publish --dry-run for do-sync@6.30.19