Adds the publish-npm job to release.yml so v*.*.* tags publish to
both Hex and npm. Tightens package.json files glob so the tarball
includes the rest/ subpath and excludes vitest files.