ci: publish to npm when a GitHub Release is published

[zanjonke]

Replaces the manual-dispatch release with the same trigger the codeplain repo uses: on: release: [published].

Fixes GH006: Protected branch update failed on run 31116826023 by removing the push entirely. Nothing writes to main, so branch protection is never in the way — and no secret is needed to get around it.

The release flow

Cut a GitHub Release tagged vX.Y.Z. The workflow then:

1. runs the test suite against the tagged tree
2. derives the version from the tag and refuses anything that isn't semver
3. refuses if that version is already on npm
4. applies the version to package.json in the runner only
5. publishes via OIDC trusted publishing, with provenance

The tag is the source of truth

Same model as the Python side, where hatch-vcs derives the version from the tag. npm has a package.json, so the version is written in the runner immediately before publish and never committed back — which is what keeps this free of release commits and secrets.

The tradeoff, stated plainly: package.json on main stays at 1.0.19 and stops tracking what's on npm. The tag and the npm registry are authoritative; the file is scaffolding.

Also in this PR

• Pre-releases publish under the next dist-tag, so marking a release as a pre-release on GitHub keeps latest stable.
• publish drops to contents: read — no tag pushing, no release creation, no PR opening. Only id-token: write remains.
• Reverted the release-PR machinery from the previous revision of this branch: ci.yml no longer needs the release/** push trigger, and pr-notify.yml no longer needs to filter bot PRs.

Repo settings allow_auto_merge / delete_branch_on_merge were enabled while exploring the previous approach; harmless to leave on, happy to turn them back off.