ci(release): auto-publish patch releases from main

[drewstone]

What changed

• Main pushes now prepare a patch release automatically: compute next patch version, commit chore(release): vX.Y.Z [skip release], and push the matching vX.Y.Z tag.
• Tag pushes keep the actual npm publish path: verify the tag matches package.json, run typecheck/test/build, publish to npm with provenance, and create a GitHub release.
• Manual Publish workflow dispatch supports user-driven minor releases (X.(Y+1).0) plus manual patch if needed.
• README documents the release behavior.

Version behavior

• Merge to main: X.Y.Z -> X.Y.(Z+1)
• Manual Publish workflow with minor: X.Y.Z -> X.(Y+1).0

Safety

• Release commits include [skip release] so the workflow does not recursively prepare another release.
• Publish is tag-only and rerunnable: existing npm versions skip the npm publish step; existing GitHub releases are not recreated.
• A concurrency group serializes release preparation/publishing.

Verification

• actionlint .github/workflows/publish.yml .github/workflows/ci.yml
• pnpm typecheck
• pnpm test (70/70 tests)
• pnpm build
• git diff --check
• Version math smoke: patch 0.8.0 -> 0.8.1, minor 0.8.0 -> 0.9.0