ci(publish): add publish workflow + top-level requires block

- Add .github/workflows/publish.yml with npm publish + softprops
  action-gh-release on tag push (mirrors skill repo template).
- Add top-level requires.config=[apiKey] to openclaw.plugin.json so
  ClawHub registry summary parser stops flagging Suspicious when the
  configSchema already carries anyOf + primaryCredential.

Closes Xquik-dev/xquik#2093 (parts B, C)

Author: kriptoburak

.github/workflows/publish.yml

@@ -0,0 +1,30 @@
+name: Publish to npm
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
+      - run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          tag_name: ${{ github.ref_name }}

openclaw.plugin.json

@@ -5,6 +5,9 @@
   "description": "Post tweets, reply, like, retweet, follow, DM from your chat - full X/Twitter automation powered by Xquik. 111 endpoints, reads from $0.00015/call.",
   "primaryCredential": "apiKey",
   "alternateCredentials": ["tempoSigningKey"],
+  "requires": {
+    "config": ["apiKey"]
+  },
   "configSchema": {
     "type": "object",
     "additionalProperties": false,