ci(release): fail the sub-package publish step on any single failure, fix llvm-mingw asset URL

Two first-tag blockers found in review:

- The platform publish loop had no failure propagation: with seven
  sequential npm publishes and no set -e, a mid-loop failure (OIDC not
  yet configured on one package, registry hiccup) would still let the
  step pass and the main package would ship with missing
  optionalDependencies. Now set -euo pipefail; a failed run can simply
  be re-run (npm rejects already-published versions but later packages
  still go out).
- The win32-arm64 llvm-mingw pin referenced
  ...-ucrt-ubuntu-20.04-x86_64.tar.xz, which does not exist in the
  20250417 release (404) — the release only ships an ubuntu-22.04
  variant. Updated URL and extraction dir.

Author: johnsoncodehk

.github/workflows/release.yml

@@ -101,8 +101,8 @@ jobs:
       - name: Install llvm-mingw
         if: matrix.llvm_mingw
         run: |
-          curl -sSL https://github.com/mstorsjo/llvm-mingw/releases/download/20250417/llvm-mingw-20250417-ucrt-ubuntu-20.04-x86_64.tar.xz | sudo tar -xJ -C /opt
-          echo "/opt/llvm-mingw-20250417-ucrt-ubuntu-20.04-x86_64/bin" >> "$GITHUB_PATH"
+          curl -sSL https://github.com/mstorsjo/llvm-mingw/releases/download/20250417/llvm-mingw-20250417-ucrt-ubuntu-22.04-x86_64.tar.xz | sudo tar -xJ -C /opt
+          echo "/opt/llvm-mingw-20250417-ucrt-ubuntu-22.04-x86_64/bin" >> "$GITHUB_PATH"
 
       - name: Build bridge (stripped)
         run: node tools/build-bridge.js
@@ -163,6 +163,7 @@ jobs:
 
       - name: Publish platform sub-packages
         run: |
+          set -euo pipefail
           for d in subpkgs/*; do
             echo "== publishing $(basename "$d") =="
             (cd "$d" && npm publish --provenance)