fix(ci): publish to JSR (Deno project), not npm — repair broken publish

preference-injector is Deno + ReScript (deno.json, JSR name, NO package.json),
but publish.yml ran 'npm ci / npm publish' — which can never work without a
package.json (this is why the failure only ever surfaced at release time). The
correct registry is JSR. Switches publish.yml to setup-deno -> deno task build
-> deno publish, with id-token: write so JSR records build provenance natively.
Adds the required 'exports' to deno.json (was missing, so JSR couldn't resolve
the entry).

NOTE: first release will validate the build chain — 'deno task build' runs
'rescript build', which needs the ReScript toolchain available in CI; if that
toolchain isn't wired (no package.json to install rescript from), that's a
pre-existing build gap to close separately.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/publish.yml

@@ -8,33 +8,26 @@ on:
   release:
     types: [created]
 
+# This is a Deno + ReScript project (deno.json, JSR name @hyperpolymath/
+# preference-injector, no package.json) — it publishes to JSR, not npm. The
+# previous npm publish could never run (npm needs a package.json). JSR records
+# build provenance natively from the OIDC token (id-token: write below).
 jobs:
-  publish-npm:
+  publish-jsr:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: read
-      id-token: write
-
+      id-token: write   # JSR build provenance is minted from this
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Setup Deno
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
         with:
-          node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
-
-      - name: Build
-        run: npm run build
-
-      - name: Publish to npm
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          deno-version: v2.x
+      - name: Build (ReScript -> JS)
+        run: deno task build
+      - name: Test
+        run: deno task test
+      - name: Publish to JSR
+        run: deno publish

deno.json

@@ -1,6 +1,7 @@
 {
   "name": "@hyperpolymath/preference-injector",
   "version": "2.0.0",
+  "exports": "./src/rescript/PreferenceInjector.bs.js",
   "tasks": {
     "dev": "deno run --watch --allow-all src/rescript/PreferenceInjector.bs.js",
     "start": "deno run --allow-all src/rescript/PreferenceInjector.bs.js",
@@ -22,7 +23,10 @@
     "pqc-kyber": "npm:pqc-kyber@1.0.0"
   },
   "compilerOptions": {
-    "lib": ["deno.window", "deno.unstable"],
+    "lib": [
+      "deno.window",
+      "deno.unstable"
+    ],
     "strict": true,
     "allowJs": true,
     "checkJs": false
@@ -34,16 +38,34 @@
     "semiColons": true,
     "singleQuote": true,
     "proseWrap": "preserve",
-    "include": ["src/", "tests/", "examples/", "scripts/"],
-    "exclude": ["*.bs.js"]
+    "include": [
+      "src/",
+      "tests/",
+      "examples/",
+      "scripts/"
+    ],
+    "exclude": [
+      "*.bs.js"
+    ]
   },
   "lint": {
     "rules": {
-      "tags": ["recommended"],
-      "exclude": ["no-unused-vars"]
+      "tags": [
+        "recommended"
+      ],
+      "exclude": [
+        "no-unused-vars"
+      ]
     },
-    "include": ["src/", "tests/", "examples/", "scripts/"],
-    "exclude": ["*.bs.js"]
+    "include": [
+      "src/",
+      "tests/",
+      "examples/",
+      "scripts/"
+    ],
+    "exclude": [
+      "*.bs.js"
+    ]
   },
   "lock": false
 }