Add tag-triggered npm publish workflow (dry run: 8.0.1-alpha.0)

[mckalexee]

Summary

• Adds .github/workflows/publish.yml — publishes @faceteer/cdk on any v* tag push, authenticating via npm Trusted Publishing (OIDC) so no NPM_TOKEN secret is needed. Provenance attestation is automatic.
• Adds publishConfig.access: public to package.json so scoped-package access is explicit.
• Bumps version to 8.0.1-alpha.0 as a dry run. This goes to the alpha dist-tag, leaving latest (currently 8.0.0) untouched.

How the workflow picks a dist-tag

Derived from the version string:

Version	dist-tag
X.Y.Z	latest
X.Y.Z-alpha.N	alpha
X.Y.Z-beta.N	beta
X.Y.Z-rc.N	rc

The workflow also verifies v${package.json.version} matches the pushed tag name and refuses to publish if they diverge.

Test plan

• Merge this PR.
• On main, create and push the tag: git checkout main && git pull && git tag v8.0.1-alpha.0 && git push origin v8.0.1-alpha.0 (or use the Releases UI targeting main).
• Watch the Publish workflow in the Actions tab.
• Confirm npm view @faceteer/cdk dist-tags shows alpha: 8.0.1-alpha.0 and latest: 8.0.0 (unchanged).
• Confirm the new version page on npmjs.com shows the "Built and signed on GitHub Actions" provenance badge.

A follow-up PR will carry the Node 24 NotificationHandler fix from #58 plus a bump to 8.0.1.

[github-actions]

Test Results

 1 files  ±0   9 suites  ±0   12s ⏱️ -1s
33 tests ±0  33 ✅ ±0  0 💤 ±0  0 ❌ ±0 
34 runs  ±0  34 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit b3a4b27. ± Comparison against base commit b0dfa3a.

♻️ This comment has been updated with latest results.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.88%. Comparing base (b0dfa3a) to head (b3a4b27).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #60   +/-   ##
=======================================
  Coverage   82.88%   82.88%           
=======================================
  Files          24       24           
  Lines         625      625           
  Branches      148      148           
=======================================
  Hits          518      518           
  Misses        105      105           
  Partials        2        2           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.