ci: fix release-please wiring

[ashutosh-ukey]

Summary

The release workflow was checking needs.release-please.outputs.did-create-release, but Circle's shared conventional-commit-release workflow exposes release_created instead. This caused the npm-publish job to be skipped even after a release was created. This change updates the condition to use release_created so npm publishing follows the actual shared workflow output contract.

Changes

• update .github/workflows/release.yml to gate npm-publish on needs.release-please.outputs.release_created
• align the npm publish job with the same release signal already used by release-sbom

Validation

• reviewed the failed release-please run 23267482209
• confirmed the shared workflow contract exposes release_created
• confirmed Circle internal docs reference release_created for downstream gating