Add trusted npm publishing with provenance

[kbaghini]

Summary

Adds npm trusted publishing to the version-tag release workflow.

Why

Trusted publishing uses GitHub OIDC instead of a long-lived npm token and automatically creates package provenance for public packages.

Behavior

For a pushed v* tag, the workflow now:

1. Installs and tests the exact tagged source.
2. Verifies the package tarball.
3. Rejects tags that do not match package.json.
4. Publishes through npm trusted publishing, or safely recognizes an already-published exact version.
5. Creates the matching GitHub Release.

The workflow cannot publish until the npm package is configured to trust kbaghini/node-idb and .github/workflows/release.yml.

Validation

• 41 tests passed
• Package dry-run passed
• Workflow and documentation formatting passed