[CI] Publish the npm package on tags via trusted publishing

Add a Release on NPM workflow, modeled on symfony/ux, that publishes
@symfony/reprise on a v*.*.* tag push. It uses OIDC trusted publishing
(no NPM_TOKEN, id-token: write), verifies the tag is on main, builds with
pnpm, and runs pnpm publish --recursive --access public --no-git-checks
--provenance. Adapted for Reprise's single package on main (dist is built
in CI, not committed).

Author: Kocal

.github/workflows/release-on-npm.yaml

@@ -0,0 +1,56 @@
+name: Release on NPM
+
+on:
+    push:
+        tags:
+            - 'v*.*.*'
+
+permissions:
+    id-token: write # Required for OIDC
+    contents: read
+
+concurrency:
+    group: release-on-npm-${{ github.ref_name }}
+    cancel-in-progress: false
+
+jobs:
+    release:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                  ref: ${{ github.ref }}
+                  persist-credentials: false
+                  fetch-depth: 0
+
+            - name: Verify tag is on the main branch
+              run: |
+                  set -euo pipefail
+                  git fetch --no-tags origin refs/heads/main:refs/remotes/origin/main
+                  if ! git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main; then
+                      echo "::error::Tag ${GITHUB_REF_NAME} (${GITHUB_SHA}) is not an ancestor of main. Refusing to publish."
+                      exit 1
+                  fi
+                  echo "Tag ${GITHUB_REF_NAME} verified as ancestor of main."
+
+            # Pinned explicitly to avoid pulling a compromised "latest" at release time; bump via dedicated PR.
+            - run: npm i -g corepack@0.35.0 && corepack enable
+              # setup-node does not enable any package-manager cache here (no `cache:` input),
+              # so cache poisoning is not a concern on this release workflow.
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # zizmor: ignore[cache-poisoning] v6.4.0
+              with:
+                  registry-url: 'https://registry.npmjs.org'
+                  node-version-file: '.nvmrc'
+
+              # npm 11.5.1 or later is required for OIDC. Pinned explicitly to avoid
+              # pulling a compromised "latest" at release time; bump via dedicated PR.
+            - run: npm install -g npm@11.16.0
+
+            - name: Install root JS dependencies
+              run: pnpm install --frozen-lockfile
+
+            - name: Build JS assets
+              run: pnpm run build
+
+            - name: Publish on NPM
+              run: pnpm publish --recursive --access public --no-git-checks --provenance