Epic: Migrate NPM publishing from auto to release-please

[jackw]

Background

We need to stop direct pushes to main. Today, auto shipit (in .github/workflows/ci.yml on push to main) writes two [skip ci] commits and N tags directly to main via the platform bot. That needs to change.

Goal

Replace Auto's main-branch publishing with googleapis/release-please-action@v4 driving a PR-driven release lifecycle:

• release-please opens a long-running release PR with version bumps + per-package changelogs
• Merging the PR triggers per-package tags, GitHub Releases, and npm publishing (with provenance via OIDC)
• No direct writes to main from CI

Tasks

• Replace Auto-driven canary publishing with pkg.pr.new (merged)
• side-effects ahead of the migration (merged)
• release-please migration (merged)
• Auto retirement cleanup (merged)