ci: add npm Trusted Publishing workflow

Add .github/workflows/publish.yml: on push to main, run the check matrix
(check/smoke/pack:check on Node 18/20/22), then publish to npm via OIDC
Trusted Publishing with no stored NPM_TOKEN. Publish-on-version-change:
package.json version is the source of truth and the publish step only runs
when that version is not yet on npm. Publish job requires id-token: write
and is gated behind a release environment.

Workflow file only; first publish + npm Trusted Publisher config left to a
human.