Publish from CI on a version tag

[stromcom]

Why

Releasing depended on whoever happened to hold a working npm login. That is how 0.3.0 ended up tagged in git but never published to npm — the registry still serves 0.1.0 as latest, with 0.2.0 missing too.

What

.github/workflows/publish.yml — pushing a bare version tag (0.3.1, matching this repo's existing tag style) runs lint, format:check, test and build, then publishes.

• Tag/version guard. The job fails if the tag does not equal package.json's version. This is precisely the 0.3.0 failure mode: tag said 0.3.0, package.json said 0.2.0.
• Provenance. id-token: write + --provenance attaches an attestation linking the tarball to this commit and workflow.
• publishConfig.access: "public" in package.json, so a publish can never silently fall back to a restricted one — scoped packages default to restricted.

Setup needed before the first run

Add a repository secret NPM_TOKEN — an npm Automation token (Access Tokens → Generate New Token → Automation) for an account with publish rights on the @stromcom scope. Granular tokens work too; a "Read-only" token does not.

If you would rather not store a token at all, npm Trusted Publishing (OIDC) is the alternative: configure this repo and workflow as a trusted publisher on npmjs.com and drop the NODE_AUTH_TOKEN env. Happy to switch it over.

Releasing from here

npm version <patch|minor|major> --no-git-tag-version   # or edit package.json
git commit -am "chore(release): X.Y.Z" && <merge to master>
git tag X.Y.Z && git push origin X.Y.Z

Master is already at 0.3.1, so once this lands, pushing the 0.3.1 tag publishes it.