- update github actions publish workflow: rename to "publish to npm" and
  accept tags matching v*
- add id-token: write permission and keep contents: read
- consolidate checkout/setup-node steps, set node 20 and registry url
- run npm ci, build, and publish with provenance and public access
- add .gitignore to ignore /node_modules
- add package-lock.json
- bump license copyright year to 2026