ci: publish npm packages via ESRP instead of npm token

[Saadnajmi]

Summary

• pack all non-private npm workspaces into a narrow NpmPackedTarballs pipeline artifact
• publish eligible stable releases through a 1ES production releaseJob using EsrpRelease@11
• filter already-published package versions before release, preserving the previous tolerate-republish behavior
• remove direct npmAuthToken configuration and token-based npm publish from the pipeline

Release behavior

The existing release eligibility and primary dist-tag selection are unchanged: main remains a no-op, release candidates use next, current releases use latest, and older stable branches use their <minor>-stable tag.

ESRP accepts one productstate, so secondary aliases are intentionally deferred to a follow-up token-free solution. During this first step, a latest release will not also update its <minor>-stable alias, and promotion of a new latest will not additionally update <minor>-stable/next.

ESRP onboarding

Before the first eligible release, populate these values in the existing React-native-macos Secrets variable group and authorize the service connection for this pipeline:

• EsrpConnectedServiceName
• EsrpKeyVaultName
• EsrpAuthCertName
• EsrpSignCertName
• EsrpClientId
• EsrpTenantId
• EsrpOwners
• EsrpApprovers

The release job validates these values before invoking ESRP.

Validation

• node --test .ado/scripts/__tests__/*-test.mts (9 tests)
• real repository dry pack produced only react-native-macos and react-native-macos-init
• generated RNM package content matched direct Yarn workspace packing
• published/missing/error npm registry cases verified
• changed YAML parsed successfully; Prettier and git diff --check passed
• independently judged exact 0.83-stable head: PASS_TO_COMMIT_AND_LAND

[Saadnajmi]

Closing in favor of a simplified ESRP migration that reuses Yarn packing helpers, adopts the RNW one-tag-per-line model, and will be propagated through the prepared release stack.