Enable npm Trusted Publishing (CI cannot publish today)

[tyejcoleman]

CI (release.yml) cannot publish — no NPM_TOKEN, no Trusted Publishing — so every release (2.0.0→2.11.0) went out via maintainer CLI with no provenance. The workflow is already OIDC-ready (id-token: write).

Action (maintainer, ~2 min, one-time): npmjs.com → package keyoku → Settings → Trusted Publishing → add repo Keyoku-ai/keyoku, workflow release.yml. See docs/PUBLISHING.md.

Done when: a pushed tag publishes automatically from CI with provenance.

[tyejcoleman]

Maintainer action (cannot be automated — npmjs.com web UI):

1. npmjs.com → sign in as the keyoku owner.
2. Package keyoku → Settings → Trusted Publishing → Add publisher.
3. Repository Keyoku-ai/keyoku, workflow filename release.yml, environment blank.
4. Save. Next git tag vX.Y.Z && git push --tags publishes automatically from CI with provenance.

The workflow is already OIDC-ready (id-token: write, npm upgraded). Until then, releases go via authed CLI (npm publish). Leaving open for the one-time toggle.