fix(release): correct 1.4.2 publish preflight

[randlee]

Fixes #497, #500, #501, and #502 for the 1.4.2 release preparation.

• Restores separate, target-conditional TestPyPI and production upload steps with the standardized API-token names while retaining manifest-driven asset and repository selection.
• Makes preflight inspect only protected-environment secret names through the GitHub API, without binding the job to an approval-gated environment or exposing values.
• Aligns active release documentation, changelog, and release-notes inventory.

Excluded: the pure #498 version bump, #499 release-parity policy, release dispatch/tagging, and release-notes automation wiring.

[randlee]

Closing as superseded by the Phase Q / sc-publish manifest-driven per-channel publishing cutover now merged into develop (#535). This 1.4.2-specific pre-redesign release-preflight PR must not be rebased or merged over the current workflow.