ci: automated npm publish + GitHub Release on version tag

[Astralchemist]

Adds .github/workflows/release.yml so releases stop being manual.

Trigger

Push a version tag: git tag v0.1.5 && git push origin v0.1.5 (or run via workflow_dispatch).

What it does

1. Sets up Bun + Node (with npm registry auth).
2. bun install --frozen-lockfile.
3. Guards that the tag (v0.1.5) matches package.json (0.1.5) — a mistagged push can't publish the wrong version.
4. npm publish --access public using the NPM_TOKEN secret — prepublishOnly still runs the full build + tests + gen/compat/migration gates before upload.
5. gh release create with auto-generated notes.

Setup

• Repo secret NPM_TOKEN is set (granular automation token with publish + bypass-2FA).
• Standard release flow from now on: bump package.json → merge to main → tag vX.Y.Z → push tag → CI publishes + cuts the Release. No more local npm publish with a hand-pasted token.

🤖 Generated with Claude Code