ci: add staged npm publishing

[b2m9]

Summary

• stage npm releases through GitHub Actions trusted publishing
• validate release tags and the package before staging
• document the release flow and assign ownership of workflow changes

Validation

• full package check: 90 tests, typecheck, lint, format, build, publint, and attw
• npm package dry-run
• workflow YAML parse

---

Summary by cubic

Adds a GitHub Actions workflow to stage npm releases with trusted publishing. Validates the release tag and package, and documents the release steps.

• New Features

  • Publish workflow stages the package on npm (not live) and requires maintainer approval with 2FA.
  • Ensures the GitHub Release tag equals v<package.json version>; blocks prerelease versions without an explicit npm dist-tag.
  • Runs full checks and npm pack --dry-run before staging.
  • Uses OIDC (id-token), Node 24, and installs npm@11.15.0 for staged publishing.
  • Protects CI workflows via CODEOWNERS (/.github/workflows/** owned by @b2m9).

• Migration

  • Follow the checklist in RELEASING.md (create a matching tag and GitHub Release).
  • After staging completes, approve the package on npm with 2FA.

^{Written for commit 39c9581. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>