fix: add npm-publish job to release.yml, robust backmerge

[Jing-yilin]

Problem

Two structural bugs in the release pipeline:

1. npm never published after v0.2.2: release.yml creates the GitHub Release using GITHUB_TOKEN. GitHub explicitly does not trigger other workflows from events caused by GITHUB_TOKEN, so publish.yml (listening on release: published) was never triggered for v0.2.3+.

2. Backmerge fails on every release: Squash-merge strategy causes git history to diverge between main and develop, making direct git merge main fail with conflicts every time.

Changes

release.yml

• Add npm-publish job (runs after github-release, uses NPM_TOKEN) — no longer relies on the broken release: published trigger chain
• Fix backmerge: try direct merge first; on conflict, create a chore/backmerge-vX.Y.Z branch with -X theirs and open a PR to develop instead of failing

publish.yml

• Add workflow_dispatch trigger as a manual escape hatch for one-off backfills

v0.2.3 backfill

Triggered publish.yml via workflow_dispatch — v0.2.3 is now live on npm (@resciencelab/declaw@0.2.3).