feat(publish): per-lexicon independent versioning and publish-on-merge

[lex00]

Closes #528.

Summary

• New .github/workflows/publish-on-merge.yml — publish-on-merge workflow with the push: trigger commented out (safety gate). Only workflow_dispatch is active. Merging this PR publishes nothing.
• Extended LexiconUpgradeOp (pull-request mode, pinned lexicons) to bump the lexicon's package.json version alongside the spec version constant. Semver label drives the bump: minor → minor bump, breaking → major bump. Rolling lexicons excluded (feat(lexicon-upgrade): rolling lexicons should emit a drift issue, not a baseline-only PR #546).
• New exports: computeBumpedVersion, bumpPackageJsonVersion, BumpPackageVersionFn (all injectable).
• Unit tests for the new logic; all 27 tests in lexicon-upgrade.test.ts pass.
• Docs note on independent versioning in guide/managing-lexicons.mdx.

Safety gate

The push: trigger in publish-on-merge.yml is commented out with an explicit explanation:

# SAFETY GATE: the `push:` trigger below is intentionally commented out.
# Merging a PR that only adds this file is a no-op for npm — nothing
# publishes until a human removes the comment block.
#
# on:
#   push:
#     branches: [main]

Only workflow_dispatch is wired. Merging this PR cannot publish any package.

To un-gate: confirm the trusted-publisher OIDC record on npmjs.com covers publish-on-merge.yml, then remove the comment block on the push: trigger.

Publish-on-merge flow (once un-gated)

1. Push to main triggers the workflow.
2. For each of the 11 packages: read local package.json version; call npm view <pkg> version.
3. If equal → print "Already at X, skipping" and exit that step.
4. If different → run npm run prepack (generates/bundles/validates) then npm publish --access public --provenance.
5. OIDC trusted-publisher record issues a short-lived publish token — no stored secrets.

Version-bump-in-PR flow (pinned lexicons)

When a LexiconUpgradeOp in pull-request mode finds a pinned upgrade with validation passing:

1. Applies the spec version bump to versions.ts (existing _applyBump).
2. Reads the current version from package.json.
3. Calls computeBumpedVersion(current, semverLabel) → new version string.
4. Calls bumpPackageJsonVersion(pkgJsonPath, newVersion) to write the new version.
5. Stages the changed package.json alongside the spec constant change.

Merging that PR carries both changes to main, which triggers publish-on-merge for exactly that lexicon.

Validation

npx tsc --noEmit -p packages/core/tsconfig.json  # clean
npx vitest run lexicons/temporal/src/op/activities/lexicon-upgrade.test.ts  # 27/27 pass
node -e "yaml.load(fs.readFileSync('.github/workflows/publish-on-merge.yml'))"  # valid YAML, on: {workflow_dispatch: null}

Deferred

• Rolling lexicons (aws, azure, github) are not version-bumped by the upgrade Op. Per the issue, they move to drift-issues (feat(lexicon-upgrade): rolling lexicons should emit a drift issue, not a baseline-only PR #546).
• Un-gating the push trigger requires a human to verify the trusted-publisher OIDC record first.
• Compatibility matrix CI (testing lexicon@X against chant@Y combinations) is not in scope for this PR.