Add release-triggered NPM publish workflow

[Copilot]

Related issue

Handled by system issue-link automation.

Screenshot before and after this change

N/A — this is a CI/release automation change.

This PR adds an automated npm release path for new features by publishing on GitHub Release publication, with guardrails to prevent bad or duplicate publishes.

• Trigger + permissions

  • Adds .github/workflows/npm-release.yml
  • Runs on release: published
  • Uses least-privilege job permissions (contents: read)

• Publish safeguards

  • Verifies release tag version (vX.Y.Z or X.Y.Z) matches package.json version
  • Checks npm for existing name@version and skips if already published
  • Fails fast on unexpected npm registry query errors

• NPM publication

  • Uses actions/setup-node with npm registry configuration
  • Publishes with npm publish --access public
  • Authenticates via NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

on:
  release:
    types: [published]

- name: Validate release version
  run: |
    RAW_TAG="${GITHUB_REF_NAME}"
    TAG_VERSION="${RAW_TAG#v}"
    PACKAGE_VERSION="$(node -p "require('./package.json').version")"
    [ "$TAG_VERSION" = "$PACKAGE_VERSION" ]