fix: publish workflow — dispatch trigger, version-aligned tags

Switched from release:published to workflow_dispatch so the version
bump is committed and tagged before npm publish. Tag and package.json
now always match.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: BrainSlugs83

.github/workflows/publish.yml

@@ -1,8 +1,12 @@
 name: Publish to npm
 
 on:
-  release:
-    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to publish (e.g. 1.6.0)'
+        required: true
+        type: string
 
 jobs:
   publish:
@@ -21,12 +25,26 @@ jobs:
       - run: npm install -g npm@latest
       - run: npm ci
 
-      # Set package version from release tag (e.g. v1.6.0 → 1.6.0)
-      - name: Set version from tag
-        run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-          npm version "$VERSION" --no-git-tag-version --allow-same-version
+      # Bump package.json to the requested version
+      - name: Set version
+        run: npm version "${{ inputs.version }}" --no-git-tag-version --allow-same-version
 
       - run: npm run check
 
+      # Commit version bump, tag, and push
+      - name: Commit and tag
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add package.json package-lock.json
+          git commit -m "v${{ inputs.version }}"
+          git tag "v${{ inputs.version }}"
+          git push origin main --tags
+
+      # Create GitHub Release from the new tag
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "v${{ inputs.version }}" --generate-notes
+
       - run: npm publish --provenance --access public