fix(ci): publish npm tarball via ./-prefixed local path (#182)

`npm publish dist-tarball/fli-X.Y.Z.tgz` failed with a git error:

  npm error command git ... ls-remote ssh://git@github.com/dist-tarball/fli-0.0.1.tgz.git
  npm error git@github.com: Permission denied (publickey).

npm's arg parser treats a bare path containing exactly one slash (and no
leading ./) as a GitHub `owner/repo` shorthand, so it tried to git-clone
`dist-tarball/fli-0.0.1.tgz` instead of publishing the local tarball.
Prefixing with `./` forces npm to classify it as a file path.

Co-authored-by: Claude <noreply@anthropic.com>

Author: punitarani

.github/workflows/publish-npm.yml

@@ -169,5 +169,8 @@ jobs:
             echo "::error::No tarball found in dist-tarball/"
             exit 1
           fi
-          echo "Publishing ${tarball}"
-          npm publish "${tarball}" --provenance --access public
+          # `npm publish <path>` treats a bare one-slash path like
+          # `dist-tarball/foo.tgz` as a GitHub owner/repo shorthand and tries to
+          # git-clone it. The leading `./` forces npm to treat it as a local tarball.
+          echo "Publishing ./${tarball}"
+          npm publish "./${tarball}" --provenance --access public