Recognize published PyPI package in release readiness

[Evilander]

Post-release hardening from the final audit.

• Adds a PyPI JSON registry check to the release-readiness CLI so audrey-memory==1.0.0 is treated as already published instead of still requiring runtime publish credentials.
• Keeps the programmatic readiness helper backward-compatible unless registry checking is explicitly requested.
• Adds focused tests for unpublished/no-credential and already-published PyPI states.

Verification from a fresh clone under .tmp/postrelease-readiness-*:

• npm ci passed.
• npm run build passed.
• npm run typecheck passed.
• npm run test:artifacts passed.
• npx vitest run tests/release-readiness-pypi.test.js tests/guardbench.test.js -t "PyPI release readiness|release readiness" passed: 4 tests.
• npm run release:readiness -- --json passed with npm-package-target and pypi-package-target both marked published.