* Add npm publish workflow triggered by version tags

- Add publishConfig with public access for scoped package
- Add GitHub Actions workflow that runs CI checks then publishes
  to npm on v* tag push with provenance
- Verify tag matches package.json version before publishing

* Verify tag is on main branch before npm publish

Fetch full history and check that the tagged commit is an ancestor of
origin/main. Prevents accidental publishes from feature branches.