ci(release): pin @napi-rs/cli to 3.8.6 and make PyPI/Maven publish idempotent

[hogan-yuan]

Two related release-workflow fixes so v5.0.0's Node.js SDK can be published and
future release re-runs are safe.

1. Fix npm publish — pin @napi-rs/cli to 3.8.6

publish-nodejs-sdk installed the napi CLI unpinned (npm install -g @napi-rs/cli),
so it floated to latest. v5.0.0 picked up 3.9.1, whose napi prepublish
(run via prepublishOnly before npm publish) fails with:

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/longbridge-win32-x64-msvc
npm error command sh -c napi prepublish -t npm

Not transient — reproduced identically on two re-runs, and v5.0.0 never reached
npm (still 4.5.0). v4.5.0 (2026-08-14) published cleanly on 3.8.6 (latest at
the time); 3.9.0 (09-02) / 3.9.1 (09-10) broke it. Pinned to @napi-rs/cli@3.8.6.

2. Make PyPI / Maven publish idempotent

So the release can be safely re-cut (e.g. to retry one SDK's publish) without the
already-published SDKs failing:

• PyPI: pypa/gh-action-pypi-publish now uses skip-existing: true (was
  unset → errored on an already-published version).
• Maven Central: releases are immutable, so a re-deploy fails. Added a step
  that checks repo1.maven.org/.../io/github/longbridge/openapi-sdk/<version>/
  and skips Update version / Import GPG / Deploy when the version already
  exists.

crates.io was already guarded (check published version), so all four registries
are now re-run-safe.

After merge — publishing npm 5.0.0

With this merged, advancing the release branch to a commit containing these
fixes re-runs the Release workflow: crates.io skips, PyPI skip-existing, Maven
skips (5.0.0 already there), and nodejs publishes 5.0.0 with the pinned napi.
Companion PR #593 splits the cpp BJ/HK uploads so those no longer flake the run.