promote-latest.sh: add a timeout to npm calls #373

Follow-up from #366 (the latest promote tool).

No npm invocation in scripts/promote-latest.sh has a timeout. A stalled registry leaves
the tool hung on a view or a dist-tag add call; the only escape is a signal, which now
rolls back — but the script still waits on the stuck call until it returns.

Bound each npm call (a timeout-style wrapper) so a stall fails fast and feeds the normal
failure/rollback path with an honest message, rather than hanging mid-promote.

Refs #366