v0.8.0

fix(release): stage the npm publish for 2FA approval, as exeris-sdk and exeris-tooling do (#66)

Motivation:
The publish job ran a direct npm publish. The organisation publishes to npm by
npm stage publish (exeris-sdk's publish-ui-kit.yml, exeris-tooling's release.yml): CI stages
the version with a stage-only token, and it goes live only when a maintainer approves it with 2FA.
The direct publish also passed out/<name>.tgz, which npm parsed as a GitHub owner/repo
shorthand, so the job failed at git ls-remote.

Modification:

• release.yml: the publish job is split in two. npm-stage runs in the npm-publish
  environment, verifies the checksummed release files, installs npm 11.15 or later and runs
  npm stage publish ./out/exeris-ai-bridge-<version>.tgz --tag latest with NPM_TOKEN.
  registry waits up to 60 minutes for the approved version on npm, then publishes to the MCP
  Registry and creates the GitHub Release; past the wait it is re-run.
• package.json: publishConfig.provenance is true, so the staged version carries a provenance
  statement signed through the job's OIDC token.
• CONTRIBUTING.md and ROADMAP.md describe staging and approval instead of trusted publishing.

Result:
A v* tag stages @exeris/ai-bridge on npm; it is live after a maintainer's 2FA approval, and the
MCP Registry entry and the GitHub Release follow.

Co-authored-by: Claude Opus 5.5 noreply@anthropic.com