set up trusted publishing for ai-cli npm package (#37)

* set up trusted publishing for ai-cli npm package

Add release workflow using OIDC + npm provenance (no npm token).
Rename package to `ai-cli`, remove private flag, add repository field.
Add CHANGELOG.md with release markers for GitHub release notes.

* update README: use npm install, symlink from package