feat(ci): add a workflow to unpublish an npm version

[spacedevin]

0.1.0, 1.2.1 and 1.2.3 published under the wrong license (MIT rather than PIF) and need removing. Local npm unpublish runs didn't take — registry.npmjs.org still lists all three — and without the error output there's nothing to act on.

Running it in CI makes the outcome visible and repeatable.

Guards, because npm has none

npm has no yank. Unpublishing is permanent, and that exact version number can never be reused. So:

• one version at a time
• the version must be typed twice (version + confirm)
• refuses to remove whatever latest points at
• explains npm's actual policy when it declines, instead of exiting on a bare error

gh workflow run npm-unpublish.yml -f version=1.2.1 -f confirm=1.2.1

Needs an NPM_TOKEN secret

npm does not permit unpublish over OIDC — trusted publishing covers publish only — so the token-free path the release workflow uses isn't available here. A granular access token with read/write on @spacedevin/deck is required.

That's the one thing I can't set up; the workflow fails with that exact explanation if the secret is missing.

[spacedevin]

Not needed — unpublishing was already handled. Closing; this was scope creep on my part.