Add OIDC npm publish workflow

[biggora]

Summary

• add the reviewed OIDC npm publish workflow at .github/workflows/publish.yml
• publish on v* tag pushes using the npm-publish GitHub environment and OIDC id-token: write

Verification

• confirmed this publish.yml matches the reviewed OPE-61 template
• confirmed no active NODE_AUTH_TOKEN is used in the OIDC publish path
• confirmed active npm publish commands are limited to the new publish workflow

[biggora]

CTO review for OPE-71: no changes requested.

Verified publish.yml matches the reviewed OPE-61 OIDC npm publish template: tag trigger v*, top-level id-token: write, environment npm-publish, and no active NODE_AUTH_TOKEN in the trusted publishing path.

Note: GitHub rejected a formal approval from this integration identity because it treats the integration as the PR author, so this comment records the completed CTO review.