ci: add trusted publish workflow

[Des-ava]

Summary

• Adds .github/workflows/publish.yml to enable trusted npm publishing on version tags
• Workflow triggers on v* tag pushes, uses OIDC for authentication, and runs build + test before publishing

Test plan

• Verify workflow syntax is valid
• Confirm OIDC permissions are configured for this repo in npmjs
• Test by pushing a version tag

🤖 Generated with Claude Code

[github-actions]

Thank you for your contribution! We ask that you please read and sign our CTA Document before we can accept your contribution. You can sign the CTA simply by posting a Pull Request Comment with the following text:

---

I have read the CTA Document and I hereby sign the CTA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}