Add a release workflow: git tags, CHANGELOG, GitHub Releases, npm provenance

[sidgaikwad]

Publishing is currently a manual step from a maintainer's machine:

"release": "npm run build && npm publish"

prepublishOnly does run lint/typecheck/test, which is good — but everything around the publish is missing.

What's missing today

• No git tags. git tag returns nothing; there is no v1.0.0 / v1.0.1 / v1.0.2.
• No GitHub Releases, which follows from having no tags.
• No CHANGELOG.md. The only record of what changed across the three published versions is the pair of chore(release): 1.0.1 / chore(release): 1.0.2 commits. A consumer upgrading has no way to see what moved.
• No npm provenance. Publishing from CI with --provenance gives the package a verifiable link back to the commit and workflow that built it.

Suggested fix

A release.yml triggered on tag push (or workflow_dispatch):

permissions:
  contents: read
  id-token: write   # required for provenance

# ... checkout, setup-node with registry-url, npm ci
- run: npm run lint && npm run typecheck && npm test && npm run build
- run: npm publish --provenance --access public
  env:
    NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

CONTRIBUTING.md already mandates Conventional Commits, so release notes and the changelog can be generated from history rather than hand-written.

Backfilling tags for 1.0.0–1.0.2 at their release commits would make the history navigable retroactively.