Add web store publish workflow and tooling

- Add publish-browser-extension for Chrome/Firefox uploads
- Add manual workflow_dispatch publish.yml workflow
- Add npm publish/publish:dry-run scripts
- Gitignore .env.submit (store credentials)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: richardkmichael

.github/workflows/publish.yml

@@ -0,0 +1,31 @@
+name: Publish to Web Stores
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag (e.g. v1.0.0-rc5)'
+        required: true
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Download release artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release download "${{ inputs.tag }}" --pattern '*.zip' --pattern '*.xpi' --repo "${{ github.repository }}"
+
+      - name: Publish to web stores
+        run: npx publish-browser-extension@4 --chrome-zip *.zip --firefox-zip *.xpi
+        env:
+          CHROME_EXTENSION_ID: ${{ secrets.CHROME_EXTENSION_ID }}
+          CHROME_CLIENT_ID: ${{ secrets.CHROME_CLIENT_ID }}
+          CHROME_CLIENT_SECRET: ${{ secrets.CHROME_CLIENT_SECRET }}
+          CHROME_REFRESH_TOKEN: ${{ secrets.CHROME_REFRESH_TOKEN }}
+          FIREFOX_EXTENSION_ID: github-bookmarked-issues@extensions
+          FIREFOX_JWT_ISSUER: ${{ secrets.FIREFOX_JWT_ISSUER }}
+          FIREFOX_JWT_SECRET: ${{ secrets.FIREFOX_JWT_SECRET }}
+          FIREFOX_CHANNEL: listed

.gitignore

@@ -12,4 +12,5 @@ tests/runs/
 
 # Environment variables (may contain GitHub session credentials)
 .env
+.env.submit
 .env.expired_auth.bak