ci: automated npm publishing via OIDC, PR tests and Slack notifications

[zanjonke]

Adds three workflows: test on every PR, publish to npm automatically when the version on main changes, and Slack notifications for both.

ci.yml

Runs npm test on every pull request and on pushes to main, across Node 18, 20 and 22 (engines declares >=18). Good candidate for a required status check on main.

publish.yml

Triggers on a push to main that touches package.json, so bumping the version in a PR and merging it is the release — no tags to cut by hand.

• Gated on the test job.
• Checks npm first and skips silently if that version already exists, so unrelated package.json edits don't fail the run.
• Auth is OIDC (npm trusted publishing) — no NPM_TOKEN secret. Provenance attestations are generated automatically. Requires Node 22 / npm >= 11.5.1, hence the npm install -g npm@latest step.
• On success: tags v<version> and creates a GitHub release with generated notes.

workflow_dispatch is deliberately absent — npm warns it can cause OIDC validation mismatches.

pr-notify.yml

Posts to Slack when a PR targeting main is opened, and again when it merges. Draft PRs are skipped; closed-without-merge posts nothing. Payloads are built with jq so PR titles containing quotes can't break the JSON.

Setup required before the first publish

1. npmjs.com → /package/plain-forge/access → Trusted Publisher → GitHub Actions, with org Codeplain-ai, repo plain-forge, workflow filename publish.yml, environment blank. The filename is part of the trust contract — renaming the workflow later breaks publishing until it's updated there.
2. SLACK_WEBHOOK_URL repository secret — already added. Every notify step is guarded on it being non-empty, so the workflows still run cleanly without it.

All notifications share the one plain-forge webhook, so a version-bump merge produces: merged to main → publishing → published.