Problem
There is no tag-triggered release workflow, OIDC trusted publishing, npm provenance, crate dry-run gate, or artifact attestation.
Acceptance criteria
- Add a release workflow for tags.
- Use trusted publishing/OIDC where supported.
- Publish npm packages with provenance and verify crate package dry-runs.
- Attach release artifacts or attestations where appropriate.
Problem
There is no tag-triggered release workflow, OIDC trusted publishing, npm provenance, crate dry-run gate, or artifact attestation.
Acceptance criteria