ci: add typecheck on PR and npm publish on release

- ci.yml runs typecheck on Node 20 & 22 for every push/PR to main
- release.yml publishes to npm with provenance when a GitHub release is published (uses NPM_TOKEN secret)