Harden npm publish tag handling against template injection

[Copilot]

Summary

Fix code-injection risk in .github/workflows/npm-publish.yml by removing direct template expansion inside a shell assignment.

Changes

• Move tag expression to step environment variable:
  • TAG: ${{ inputs.tag || github.event.release.tag_name }}
• Enable strict shell mode in the step:
  • set -euo pipefail
• Validate tag format before use to prevent unsafe values:
  • allow v<semver> plus optional prerelease/build suffix style segments
• Keep existing version/tag consistency check unchanged in behavior

Validation

• npm test (before change): passed
• npm test (after change): passed
• Parallel validation:
  • Code Review: no comments
  • CodeQL Security Scan: 0 alerts

[coveralls]

coverage: 97.684%. remained the same — copilot/fix-code-injection-vulnerability into main