ci: publish npm packages with trusted publishing

[callumalpass]

Summary

• add package-specific tag releases for interop, runtime, and testbed packages
• validate tag/package version alignment and run each package's tests
• build the local interop dependency before validating runtime
• publish with npm Trusted Publishing and provenance

Verification

• all three package test suites
• npm pack --dry-run for all three packages
• actionlint