Set up npm trusted publishing

[jackyzha0]

Summary

• configure npm publish workflow for trusted publishing via GitHub Actions OIDC
• add repository metadata required for npm package provenance/trusted publishing
• update Release Drafter workflow/config to v7 syntax
• refresh README release instructions without exposing trusted publisher setup details

Testing

• ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts f }' .github/workflows/publish.yml .github/workflows/release-drafter.yml .github/release-drafter.yml
• nix shell nixpkgs#actionlint --command actionlint
• nix develop . --command npm pkg get name repository
• git diff --check