ci: add OIDC-based npm publish workflow for tagged releases

[Copilot]

This PR adds an OIDC trusted publishing path for npm releases, aligned with the v*.*.* tag-based release flow. It introduces a dedicated publish workflow modeled after the referenced pattern, without token-based npm auth.

• Release trigger and scope

  • Adds a new workflow at .github/workflows/publish.yml.
  • Triggers on pushed tags matching v*.*.* to isolate publish behavior to versioned releases.

• OIDC trusted publishing setup

  • Configures workflow permissions for OIDC:
    • id-token: write
    • contents: read
  • Uses npm provenance publish mode via npm publish --provenance --access public.

• Publish pipeline

  • Checks out source, sets up Node + npm registry, installs dependencies, builds package, then publishes.

permissions:
  id-token: write
  contents: read

on:
  push:
    tags:
      - 'v*.*.*'

# ...
- name: Publish to npm
  run: npm publish --provenance --access public