chore: add release workflow using npm trusted publishing

[captbaritone]

Adds a Release workflow so publishing happens from CI with npm trusted publishing (OIDC) instead of a maintainer's local npm token. No NPM_TOKEN secret is used or needed.

How it works

Merging to main is the only gate. On every push to main the workflow reads the version from package.json and asks npm whether that version already exists. If it does, the run is a no-op. If it does not, it runs the test suite, builds the package, publishes it with provenance, creates the vX.Y.Z tag, and opens a GitHub release.

So a release is simply a merged version bump — no tagging or npm publish by hand. Because the decision is derived from npm's state rather than from the event, re-running a failed publish is safe.

A version containing a - publishes under next rather than latest, so the pipeline can be rehearsed with something like 0.11.1-rc.0.

Why main-triggered rather than tag-triggered

A tag can point at any commit, including one that never landed on main, and tags are not covered by branch protection. A tag-triggered release would let anyone with write access publish an unreviewed commit, bypassing whatever protection main has. Keying off main means the published commit is always one that went through the branch.

Security notes

• The publish job holds the OIDC token and deliberately never runs npm ci, so no dependency lifecycle scripts execute while the token is available. It only publishes the artifact the build job produced.
• permissions: {} at the top level, with each job granted the minimum it needs.
• Provenance means every release carries a signed, publicly verifiable attestation of the repo, commit and workflow that produced it.
• This widens who can effectively publish, from npm package owners to anyone who can land a commit on main. Branch protection on main (require a PR, require status checks; no required approvals needed) is what makes that boundary meaningful, and is worth adding alongside this.

Notes

• The npm package's trusted publisher must be configured on npmjs.com pointing at this repo and release.yml. No GitHub environment is required.
• .node-version is pinned to v24 because trusted publishing needs npm >= 11.5.1. Node 22 still bundles npm 10.9.4, which is too old and would fail at publish time.
• CONTRIBUTING.md now documents the PR: * label requirement, since gen-changelog.js throws on any merged PR missing one.

Test plan

• npm run test passes (lint, tsc, 86 tests, prettier, cspell)
• Workflow YAML parses; embedded shell passes bash -n
• Version-check logic verified against published/unpublished, index-0, and single-version (bare string) responses from npm view
• dist-tag selection verified for stable and prerelease versions
• End-to-end publish, best rehearsed with a prerelease once the trusted publisher is configured

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (903ebe0) to head (9d6e95c).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #403   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           21        21           
  Lines          748       748           
  Branches        48        48           
=========================================
  Hits           748       748           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[benjie]

Trusted publishing is now ready to go npm-side. I've only allowed for it to do "npm stage publish" right now (you need to approve the release via npm), we can change this if need be

[benjie]

These versions are a little old, I think v7 is latest?