* mail: widen thread-view prev/next prefetch window to ±5

Was ±1 — forced by Gmail per-user quota when we first tripped 403s.
With history-delta + push notifications + the server-side token bucket,
the polling baseline has dropped ~100x, so we can prefetch a wider j/k
window without reintroducing rate-limit failures.

The window is [idx-5, idx+5], so a burst of up to 5 presses in either
direction lands on already-warmed threads. warmThreads dedups via the
inflight map, so re-renders that recompute the window stay cheap.

* core: consolidate publish workflows + bump to 0.7.9

npm's Trusted Publisher feature allows only one trusted workflow file per
package. Split publish.yml and auto-publish.yml have meant either manual
dispatch OR push-triggered publish could work, never both. Consolidate into
a single auto-publish.yml that handles both:

- push to main with packages/core/package.json version change -> publish
- workflow_dispatch with version_bump=patch|minor|major -> bump, commit,
  push (which then triggers the push-event publish path above)
- workflow_dispatch with version_bump=dev -> direct dev-tag publish

Bump to 0.7.9 so this merge exercises the push path end-to-end; 0.7.8 is
on main but was never successfully published to npm due to the OIDC
mismatch this PR fixes. Requires a matching npmjs.com trusted publisher
swap from publish.yml to auto-publish.yml (done separately).