fix(release): un-enroll connect-protocol from CI publish; drop lockfile edits

@paperclip/connect-protocol is not yet published to npm, so enrolling it
with publishFromCi:true fails the release bootstrap policy check. Per the
release-owner decision (accepted confirmation on PAP-14865), set
publishFromCi:false until the first npm publish is bootstrapped; a follow-up
re-enrolls it before any external consumer needs it (workspace link: dep only).

Also restore pnpm-lock.yaml to the merge-base state: CI owns lockfile
regeneration (regen_lockfile), and committing pnpm-lock.yaml trips the
'Block manual lockfile edits' policy step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/release-package-manifest.json

@@ -2,7 +2,7 @@
   {
     "dir": "packages/connect-protocol",
     "name": "@paperclip/connect-protocol",
-    "publishFromCi": true
+    "publishFromCi": false
   },
   {
     "dir": "packages/adapter-utils",