`.github/workflows/release.yml` was correctly wired to publish on
`release: types: [published]` but nothing triggered it. `@imdeadpool/guardex@7.0.42`
on npm lagged behind ~7 merged fixes (PRs #545-551 in today's audit
alone) because the manual bump step never happened.

This change adds googleapis/release-please-action@v4 as a parallel
workflow on `push: main`:

- .github/workflows/release-please.yml -- runs the action with config +
  manifest files.
- release-please-config.json -- `release-type: node`, package name,
  changelog sections (feat / fix / perf visible; chore / docs / refactor /
  test / build / ci / style hidden), `include-v-in-tag: true` so the
  tag format matches what release.yml expects.
- .release-please-manifest.json -- pins current version 7.0.42 as
  baseline.

Flow after this merges: release-please scans commits since v7.0.42,
opens a "release X.Y.Z" PR that bumps package.json + writes
CHANGELOG.md; merging that PR creates a GitHub release at the new tag;
release.yml fires on release: published and ships to npm with
provenance + cosign signing.

OpenSpec notes at
openspec/changes/agent-claude-add-release-please-automation-2026-05-11-12-30/notes.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>