feat: prep npm release — activate publish workflow, add registry metadata

[a-tokyo]

Summary

• Un-dormants release.yml: enables OIDC-based npm publish --provenance (no NPM_TOKEN secret), and creates the GitHub Release after publish succeeds so a failed publish can never leave a tag/release with no matching npm version.
• Adds registry-ready package.json metadata: drops private: true, adds publishConfig.access: public, repository, homepage, bugs. Bumps version 0.1.3 -> 0.1.4.
• Updates README: real npm i -D @zoldytech/javascript install command (replacing the GitHub-URL-pinned-tag install), adds npm version/downloads + CI badges.

Context

Prompted by creating the zoldytech npm org and auditing this repo's CI/release setup against a-tokyo/apple-signin-auth. That repo creates its GitHub Release before npm publish, and its NPM_TOKEN has been silently expired for over a month — its latest release has no matching npm version with no alerting. This PR sequences the opposite way (publish first, release second) so that failure mode can't happen here.

Prerequisite (not part of this PR)

Before the first tag push will actually publish, OIDC trusted publishing needs to be enabled on npmjs.com for this package: Settings -> Trusted Publisher -> GitHub Actions -> Zoldytech/javascript -> release.yml.

Test plan

• npm run lint passes
• npm test passes (22/22)
• release.yml YAML validated
• After merge: enable npm trusted publisher, then push tag v0.1.4 and confirm the release workflow publishes to npm and creates a GitHub Release
• Backfill missing GitHub Releases for tags 0.1.1, 0.1.2, 0.1.3 (tracked separately, not in this PR)

[Copilot]

Pull request overview

Prepares this package for an npm registry release by enabling an OIDC-based publish workflow, updating package.json with publish-ready metadata, and aligning the README with npm-based installation and status badges.

Changes:

• Activated release.yml to publish to npm with provenance and create a GitHub Release afterward.
• Updated package.json for public publishing (removed private, added publishConfig, repo/homepage/bugs metadata) and bumped version 0.1.3 → 0.1.4.
• Updated README with npm install command and added npm/CI badges.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
README.md	Adds npm/CI badges and switches install instructions to npm i -D @zoldytech/javascript.
package.json	Adds npm registry metadata, enables public publishing, and bumps package version.
.github/workflows/release.yml	Re-enables release workflow to publish via OIDC provenance and create a GitHub Release post-publish.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[a-tokyo]

Addressed both Copilot findings in e8b6a10:

• Reworded the header comment — it now correctly states the tag itself already exists once pushed (that's the trigger), and only the GitHub Release is deferred until publish succeeds.
• Split publish and release into separate jobs with least-privilege permissions (contents: read for publish, contents: write only for release), added an explicit tag-vs-package.json-version check that fails the job on mismatch, and the release job can now be re-run independently if it fails without re-attempting npm publish.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.