ci(root): use bash retry loop for shrinkwrap verify step

The shrinkwrap-verify step called the `retry` binary, whose install step
was removed in 1c04950 (VL-7134) on the assumption it was only used by
improved-yarn-audit. `retry: command not found` then caused the step to
false-fail after a successful publish (bitgo@52.3.0 shipped correctly).

Replace the `retry` wrapper with a plain bash loop, matching the adjacent
Create GitHub release step, so the check no longer depends on a
third-party binary in the post-publish window.

TICKET: WCN-1584

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: zahin-mohammad

.github/workflows/npmjs-release.yml

@@ -342,14 +342,16 @@ jobs:
           version=$(jq -r '.version' modules/bitgo/package.json)
           # Registry metadata can lag briefly right after publish, so retry before
           # failing the release on what might just be propagation delay.
-          if ! retry --up-to 5x --every 5s -- bash -c "
-            has_shrinkwrap=\$(curl -sL 'https://registry.npmjs.org/bitgo/${version}' | jq -r '._hasShrinkwrap // false')
-            [ \"\$has_shrinkwrap\" = 'true' ]
-          "; then
-            echo "::error::Published bitgo@${version} is missing _hasShrinkwrap metadata on the npm registry."
-            exit 1
-          fi
-          echo "✅ bitgo@${version} published with _hasShrinkwrap: true."
+          for attempt in 1 2 3 4 5; do
+            has_shrinkwrap=$(curl -sL "https://registry.npmjs.org/bitgo/${version}" | jq -r '._hasShrinkwrap // false')
+            if [ "$has_shrinkwrap" = 'true' ]; then
+              echo "✅ bitgo@${version} published with _hasShrinkwrap: true."
+              exit 0
+            fi
+            [ "$attempt" -lt 5 ] && sleep 5
+          done
+          echo "::error::Published bitgo@${version} is missing _hasShrinkwrap metadata on the npm registry."
+          exit 1
 
       - name: Generate version bump summary
         id: version-bump-summary