fix(ci): repair Publish workflow — native Pages deploy + automated npm publish

[smartlabsAT]

Summary

Fixes both problems that surfaced while shipping v0.2.6:

1. GitHub Pages Storybook deploy was failing — bitovi/github-actions-storybook-to-github-pages@v1.0.2 internally pulls actions/upload-artifact@v3, which GitHub disabled. The v0.2.6 publish run failed at setup (log) and the GH Pages Storybook is stuck on the pre-v0.2.6 build.
2. npm publish was not automated — the npm-publish block in publish.yml was commented out and full of placeholders. v0.2.6 had to be published manually.

Changes

.github/workflows/publish.yml rewritten as two independent jobs:

storybook-pages

• Builds Storybook
• Deploys to GitHub Pages using native actions only:
  • actions/configure-pages@v5
  • actions/upload-pages-artifact@v3
  • actions/deploy-pages@v4
• Concurrency group pages with cancel-in-progress: false so an in-flight deploy can finish before the next one starts

npm-publish

• Builds the package
• Runs npm publish --provenance --access public
• Gated on github.event_name == 'release' so manual workflow_dispatch runs (e.g. just to re-deploy Pages) won't try to re-publish the same version
• Uses repo secret NPM_TOKEN
• Declares id-token: write at the job level so npm provenance attestations can be signed via GitHub OIDC

Required before next release: add NPM_TOKEN secret

The npm-publish job depends on a repo secret called NPM_TOKEN. Without it the job will fail authentication. Steps for the repo owner:

1. On https://www.npmjs.com → Profile → Access Tokens → Generate New Token → Granular Access Token
2. Scope: only react-resize-detector-context, permission: Read and write, expiry: 1 year is reasonable
3. Copy the token (starts with npm_…)
4. GitHub: repo Settings → Secrets and variables → Actions → New repository secret named exactly NPM_TOKEN
5. Paste, save

Once that's set, the next release: published event will trigger the workflow end-to-end.

Test plan

After merging:

• Manually trigger Publish workflow via workflow_dispatch (Actions tab → Publish → Run workflow → main) to verify the storybook-pages job runs green and Pages updates to current Storybook 10 build. npm-publish will be skipped (no release event).
• On the next real release, observe both jobs succeed and the new version appears on npm with a provenance badge.

Notes

• Not in scope: husky devDep / .husky/ directory cleanup (separate concern, mentioned in fix(ci): repair Publish workflow — native GitHub Pages deploy + automated npm publish #21 as a follow-up).

Closes #21