ci: add npm Trusted Publishing release workflow

[mjradwin]

Adds a GitHub Actions workflow that publishes this package to npm via
OIDC Trusted Publishing whenever a GitHub Release is published.

• No NPM_TOKEN required (OIDC short-lived tokens).
• Provenance attestations are generated automatically.
• The workflow uses the npm-publish environment for an extra approval boundary.

Before merging, configure the trusted publisher on npmjs.com:

1. Go to https://www.npmjs.com/package//access
2. Under "Trusted Publisher", click Add and fill in:
   • Publisher: GitHub Actions
   • Organization or user: hebcal
   • Repository: this repo's name
   • Workflow filename: release.yml
   • Environment name: npm-publish

Docs: https://docs.npmjs.com/trusted-publishers/