Add an npm release workflow for the SDK

[collinsadi]

The SDK uses changesets, publint/attw checks, and publishConfig.access: public, but no workflow publishes it — releases are manual and unverifiable.

Add a release workflow driven by changesets.

Acceptance criteria:

• Merged changesets produce a versioned publish from CI with npm provenance.
• The publish runs the existing export and bundle-size checks first.
• The release process is documented alongside the SDK changelog policy.