feat: add npm publish workflow for @dash0hq/docs-invariants

[mmanciop]

Summary

Sets up the release pipeline so tag pushes matching docs-invariants-v<X.Y.Z> (or with a pre-release suffix like -alpha.1) publish the package to npm with provenance attestations.

The initial main push landed the scaffold; this PR turns the "docs-invariants publishes to npm" story from a promise in docs/releasing.md into a working workflow. First real release, docs-invariants-v0.0.1, can be cut immediately after this merges — it reserves the npm name and validates the pipeline end-to-end while the package's actual API is still being designed.

What's included

• .github/workflows/publish.yml — tag-triggered release workflow. Verifies tag version matches package.json version, reinstalls, runs typecheck + tests, then publishes with pnpm --filter @dash0hq/docs-invariants publish --access public --no-git-checks. Uses id-token: write for npm provenance and reads NODE_AUTH_TOKEN from DASH0_NPMJS_PUBLISH_TOKEN.
• packages/docs-invariants/package.json — un-masked for publication (private: true removed), version bumped to 0.0.1, added repository (with directory subpath), homepage, bugs, publishConfig (access: public, provenance: true), main, exports, and a files list using a negation glob to keep test files out of the tarball.
• packages/docs-invariants/LICENSE — symlinked to the repo-root LICENSE. Resolves to the actual Apache 2.0 text when npm packs the tarball, so the published package carries the licence without a redundant copy in the repo.
• docs/releasing.md — replaces the placeholder release procedure with the actual tag/workflow/secret contract, including the version-mismatch guard and the pre-release-tag pattern.

Prerequisites the user needs to set up before the first release runs

1. Create an npm automation token with publish access on the @dash0hq scope.
2. Add it as a repository secret on dash0hq/sync-docs-action named DASH0_NPMJS_PUBLISH_TOKEN.
3. Confirm the @dash0hq npm scope exists and the token has publish permission on it.

None of these block this PR — they gate the first tag push after merge.

Verification

• pnpm run lint clean; format:check clean; typecheck clean; 87 + 1 tests pass.
• pnpm pack inside packages/docs-invariants/ contains only LICENSE, README.md, package.json, src/index.ts.

Test plan

• CI runs and passes on this PR.
• After merge, add the npm secret, push tag docs-invariants-v0.0.1, confirm workflow publishes and npm view @dash0hq/docs-invariants shows the version with a provenance attestation link.