Add npm publish workflow (Trusted Publishing via OIDC)

Publishes to npm automatically when a `v*` tag is pushed. Uses GitHub
OIDC trusted publishing (no NPM_TOKEN secret) with provenance, so the
package gets a verifiable build attestation and there is no long-lived
credential to manage.

The job upgrades npm to >= 11.5.1 (required for trusted publishing),
installs deps with bun, verifies the tag matches package.json version,
then runs `npm publish --provenance` — which triggers the existing
prepublishOnly gate (check, typecheck, test, licenses, build).

Requires the npm package to have a Trusted Publisher configured for
this repo + the publish.yml workflow (done on npmjs.com).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: cinderblock

.github/workflows/publish.yml

@@ -0,0 +1,44 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for npm Trusted Publishing (OIDC) + provenance
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: lts/*
+          registry-url: https://registry.npmjs.org
+
+      # Trusted Publishing + provenance need npm >= 11.5.1.
+      - run: npm install -g npm@latest
+
+      - run: bun install --frozen-lockfile
+
+      - name: Verify tag matches package.json version
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          PKG="$(node -p "require('./package.json').version")"
+          echo "tag=${TAG} package.json=${PKG}"
+          if [ "${TAG}" != "${PKG}" ]; then
+            echo "::error::Tag v${TAG} does not match package.json version ${PKG}"
+            exit 1
+          fi
+
+      # `npm publish` runs the prepublishOnly gate (check, typecheck, test,
+      # licenses, build). Auth is via OIDC — no NPM_TOKEN needed.
+      - run: npm publish --provenance --access public