[javascript] Publish @seleniumhq/atoms as part of the npm release

[AutomatedTester]

🔗 Related Issues

Follow-up to #17459, which created the @seleniumhq/atoms package but did not wire it into the release.

💥 What does this PR do?

#17459 added the npm_package target and promoted javascript/atoms/package.json, but nothing ever publishes it — node:release only ran //javascript/selenium-webdriver:selenium-webdriver.publish. This connects the atoms package to the existing Node release path.

node:version already bumped both package.jsons in lockstep, so the gap was publish / verify / build:

• node:release publishes //javascript/atoms:selenium-atoms-package.publish before selenium-webdriver.publish. The existing "already published → skip" rescue is extracted into publish_npm_package so both targets share it.
• node:verify checks both packages; node:build builds both.
• setup_github_npm_auth redirects the atoms registry for the nightly GitHub Packages path. The name is already scoped so it needs no rename, but the npmjs access flag is stripped — GitHub Packages derives visibility from the repository.
• javascript/atoms/package.json gains publishConfig.access: "public". Scoped packages default to restricted on npmjs, so without this the first publish is rejected.
• node:version now fails loudly if the two versions have drifted.

🔧 Implementation Notes

Why access: public matters. This is the load-bearing bit. @seleniumhq/atoms is scoped, and npm defaults scoped packages to restricted. The dry-run output changes from default access to:

npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access (dry-run)
+ @seleniumhq/atoms@4.51.0-nightly202609302012

Why the version guard. node:version bumps by substituting old_version across four files. If the atoms version ever drifted from selenium-webdriver's, the substitution would silently no-op and leave atoms stale — which would then only surface as a node:verify failure after the release had already gone out. Failing at bump time turns a post-release surprise into an obvious pre-release error.

Why methods instead of constants. Rakefile loads node.rake twice — once as node:, once aliased as javascript:. Top-level constants produced already initialized constant warnings on every single invocation, so the shared paths/targets are methods.

Publish ordering. Atoms goes first, so the lower-level package is on the registry before anything starts depending on it. Note this means a selenium-webdriver failure can leave atoms already published; that matches the existing Ruby multi-gem behaviour in rb:release and the per-target "already published" rescue makes a re-run idempotent.

🤖 AI assistance

• AI assisted (complete below)
  • Tool(s): Claude Code
  • What was generated: the rake_tasks/node.rake changes and the publishConfig block, plus the local dry-run validation described below.
  • I reviewed all AI output and can explain the change

💡 Additional Considerations

Two follow-ups needed before the first tagged release — neither blocks this PR:

1. The first npmjs publish needs a manual bootstrap. npm only allows attaching a trusted publisher to a package that already exists, so @seleniumhq/atoms has to go out once with a granular token / npm login. After that the trusted publisher (SeleniumHQ/selenium + release.yml) can be registered and every subsequent release runs unattended — release.yml already grants id-token: write.
2. The nightly GitHub Packages path is not verified end to end. No GHP credentials locally. The package.json rewrite was checked to produce valid JSON pointing at https://npm.pkg.github.com, but the first nightly after this merges is the real test.

Not changed: the release.yml path filter still lists only javascript/selenium-webdriver/package.json. Version-bump PRs always touch that file, so the trigger already fires; adding the atoms path would be redundant.

✅ Validation

• ./go javascript:release dry-run — passes end to end, both packages, exit 0, no warnings.
• ./scripts/format.sh — passes (rubocop, 362 files, no offenses).
• Confirmed the scoped-package verify URL shape (registry.npmjs.org/@scope%2Fname/version) returns 200 against the live registry.

🔄 Types of changes

• Cleanup (formatting, renaming)
• New feature (non-breaking change which adds functionality)