ci: consolidate dev publish into publish.yml

[ohxyz]

Why

PR #76 shipped dev publishing as a separate workflow file (dev-publish.yml). But npm trusted publishing (OIDC) allows only one workflow filename per package, and publish.yml already owns that slot. The separate file can't authenticate — its OIDC token exchange 404s, pnpm falls back to no auth, and the publish dies with E404 PUT .../bwin. (Confirmed live: the #76 merge ran the job and failed exactly this way.)

What

Fold the dev path into publish.yml as a second job, selected by trigger event:

• publish — if: github.event_name == 'workflow_dispatch'. The existing manual stable release: PUBLISH env gate, tag + release notes, latest. Unchanged.
• dev-publish — if: pull_request && merged == true. Unattended on each merged PR to main. Computes an ephemeral <next-patch>-dev-<sha> (e.g. 0.4.5-dev-9e70cf0) via npm version --no-git-tag-version — never written back to the repo — builds, and publishes under the dev dist-tag. No tag, no commit, no re-trigger loop.

Deletes the redundant dev-publish.yml.

npm-side requirement (not code)

For the dev job's OIDC to authenticate, the bwin package's npm Trusted Publisher must have its Environment field blank:

• npm matches on repo + workflow filename + environment; the dev job runs with no environment.
• A blank environment matches both jobs. The stable job's GitHub-side environment: PUBLISH approval gate is enforced by GitHub independently, so blanking the npm field does not weaken it.
• Workflow filename stays publish.yml.

Note

main currently has the broken standalone dev-publish.yml from #76; this PR removes it. Merging this supersedes #76's workflow.