Cancelling a release requires cleanup, which could be forgotten

Currently, when a release PR is merged:

- A Git tag is pushed
- The GitHub release is created
- `npm publish` is run in dry-run mode
- The release workflow is paused while waiting for approval from NPM publishers
- The release is approved
- `npm publish` is run in non-dry-run mode

This means that a release is cancelled and needs to be re-created, the Git tag and GitHub release need to be removed first. We can avoid from needing to remember to do this if we change the workflow to:

- `npm publish` is run in dry-run mode
- The release workflow is paused while waiting for approval from NPM publishers
- The release is approved
- A Git tag is pushed
- The GitHub release is created
- `npm publish` is run in non-dry-run mode

Start by locating the release workflow and reviewing the existing dry-run publish, approval, tag, GitHub release, and final publish steps. Reorder the workflow so cancellation before approval does not leave a tag or GitHub release to clean up, then verify that an approved release still completes successfully.

Written by the indexing model from the issue text.