ci: npm trusted publishing and GitHub releases #467

Why?

Packages are published with NPM_TOKEN, now a personal token of one maintainer. Since npm revoked classic tokens and limited write tokens to 90 days (December 2025), releases depend on one person's expiring token; 2.0.0-alpha.44, .45 and .47 failed to publish after the version bump was already pushed. The 2.0.0 alphas also have no GitHub releases (the last one is v1.0.1).

What?

• Publish with npm trusted publishing (GitHub OIDC): id-token: write only on the publish job, npm 11.5.1 or later (Node.js 24). This also adds provenance to the packages.
• Keep NPM_TOKEN as a fallback until the first release through OIDC has worked; remove it in a follow-up.
• Create a GitHub release with generated notes for each tag (a prerelease for versions like 2.0.0-alpha.49).
• Rename publish.yml to release.yml (Release), like the organization's other repositories, before the trusted publishers are configured (they name the workflow file).

The release flow stays the same: a maintainer pushes a v* tag on main, the workflow bumps the versions, pushes bump: vX to main and publishes.

Acceptance criteria

• The publish job can publish with OIDC once the trusted publishers are configured on npmjs.com, and still with NPM_TOKEN until then.
• A tag creates a GitHub release (prerelease for prerelease versions).