chore(ci): merge publish into release workflow

GITHUB_TOKEN tag pushes don't trigger other workflows, so the
separate publish.yml never ran. Move npm publish and GitHub Release
creation into the release workflow after the tag push step.

Author: ConsoleTVs

.github/workflows/publish.yml

@@ -6,6 +6,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   release:
@@ -43,6 +44,17 @@ jobs:
         uses: actions/setup-node@v5
         with:
           node-version-file: .nvmrc
+          cache: 'npm'
+          cache-dependency-path: package-lock.json
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        if: steps.version.outputs.bump == 'true'
+        run: npm ci --prefer-offline --no-audit --no-fund
+
+      - name: Build
+        if: steps.version.outputs.bump == 'true'
+        run: npm run build:only
 
       - name: Bump package.json version
         if: steps.version.outputs.bump == 'true'
@@ -61,3 +73,17 @@ jobs:
           git commit -m "chore(release): ${{ steps.version.outputs.version }}"
           git tag -a "${{ steps.version.outputs.version }}" -m "${{ steps.version.outputs.version }}"
           git push origin main --follow-tags
+
+      - name: Publish to npm
+        if: steps.version.outputs.bump == 'true'
+        run: npm publish --provenance --access public
+
+      - name: Generate release notes
+        if: steps.version.outputs.bump == 'true'
+        run: git-cliff --latest --strip header > RELEASE_NOTES.md
+
+      - name: Create GitHub Release
+        if: steps.version.outputs.bump == 'true'
+        run: gh release create "${{ steps.version.outputs.version }}" --title "${{ steps.version.outputs.version }}" --notes-file RELEASE_NOTES.md
+        env:
+          GH_TOKEN: ${{ github.token }}