Run the npm suite before prepare.mjs, not after

[las7]

The npm job could not publish on any tag, and cli-v0.4.0 is where that
became visible.

prepare.mjs stamps the tag's version into all five manifests -- that is
its entire purpose, because the repo deliberately carries 0.0.0-dev so a
version can never drift from the tag that produced it. The test suite ran
immediately afterwards, and one of its seventeen cases asserts exactly the
opposite:

test("the repo carries no real version: the tag is the only source")

So the step order made the job assert that prepare.mjs had not done the
thing prepare.mjs is for. Not a flake and not specific to this release:
16 pass, 1 fail, by construction, on every tag, forever.

The cost was worse than one red job. The publish step below carries a
written-out diagnostic for the one failure guaranteed to happen exactly
once -- that npm Trusted Publishing cannot be configured on a package
that does not exist yet, so the first version of each of the five has to
go by hand. cli-v0.4.0 was that once. The job died two steps early and
took the message with it, leaving a bare assertion failure where the
instructions should have been.

Moving the suite above the stamp step restores what it was written to
check: a clean tree, before anything mutates it. Verified both ways on
the cli-v0.4.0 tree with that tag's real release assets -- 17/17 on the
clean checkout, and 16/1 with the same failure after prepare.mjs runs.