ci: add release-please, npm trusted publishing

[ungoldman]

Adds planned release automation: release-please for versioning and changelog, and tokenless npm publish via OIDC trusted publishing.

How it works

On every push to main, release-please reads the conventional commits since the last release and maintains a release PR that bumps package.json and prepends to CHANGELOG.md. Merging that PR tags the version and creates a GitHub Release, which triggers the publish job: npm ci, build, then npm publish authenticated by a short-lived OIDC token. Provenance attestations are generated automatically.

Files added:

• release-please-config.json: release-type: node, with include-component-in-tag: false so tags stay vX.Y.Z (matching v3.0.2).
• .release-please-manifest.json: seeded to 3.0.2, the last published version, so release-please diffs from the v3.0.2 tag.
• .github/workflows/release.yml: the release-please job plus the OIDC publish job.

Setup needed before this can publish (only you can do these)

1. npmjs.com trusted publisher: on the format-duration package, Settings, Trusted Publishing, add a GitHub Actions publisher with org ungoldman, repo format-duration, workflow release.yml, and select npm publish as the allowed action.
2. GitHub repo setting: Settings, Actions, General, Workflow permissions, enable "Allow GitHub Actions to create and approve pull requests" so release-please can open the release PR with the default token. Best to do this before merging, since the first run happens on merge.

What happens on merge

release-please sees the refactor! breaking commit since v3.0.2 and opens a release PR for 4.0.0 with a generated changelog (the breaking-changes section comes from the commit footer, and the ci/chore/docs commits stay hidden). Review and merge that PR to cut and publish 4.0.0. If the trusted publisher is not configured yet, only the publish job fails, so configure it and re-run that job.

Note on CI

This workflow triggers on push to main, not on PRs, so it does not run on this PR. The tests workflow still runs here. release-please activates once this is merged.