ci: wire OIDC trusted publishing to npm

[maw629]

Implements docs/superpowers/specs/2026-07-18-oidc-trusted-publishing-design.md.

What changed

• .github/workflows/publish.yml: new workflow, fires on release: published, runs against the npm-publish GitHub Environment, checks out the tagged commit, sanity-checks tag ↔ package.json version, and runs npm publish --provenance using an OIDC token (no NPM_TOKEN secret).
• package.json: publishConfig block added with "access": "public" (required for scoped packages) and "provenance": true.

What did NOT change

• lib/, dist/, dependencies, devDependencies, package-lock.json, engines.node.
• The existing test CI workflow (tests.yml) — same trigger, same matrix.
• No NPM_TOKEN secret is added or referenced anywhere.

Out-of-tree setup required BEFORE the workflow can actually publish

See the spec (Sections 1–3) and plan (Tasks 4–6). This PR is safe to merge without them — the workflow only fires on release: published, which is a deliberate later act.

1. Register a Trusted Publisher on npmjs.com for @pkg-nec/exceljs with Organization=pkg-nec, Repository=exceljs, Workflow=publish.yml, Environment=npm-publish.
2. Create a GitHub Actions Environment npm-publish with reviewer maw629 and deployment rules Branch: main + Tag: v*.*.*.
3. Enable branch protection on main (PR required + all five CI checks).

Live verification

The 4.4.1 publish (Tasks 7–8 in the plan) is the end-to-end proof of the trust chain.