Publish TypeScript bindings to npm

[jupblb]

Wires up TypeScript binding publication to npm via trusted publishing (OIDC). Adds a publish-npm job to release.yaml (alongside the existing Rust/JVM/Go publish jobs) and prepares bindings/typescript for npm with proper entry points, an emitted dist/ build, and automatic provenance attestation.

The workflow uses JS-DevTools/npm-publish@v4: no NPM_TOKEN secret, no bash idempotency wrapper, and --provenance is honored via the action's input. The job is safely re-runnable — the action reads the registry first and is a no-op if @scip-code/scip@<version> is already published.

Post-merge: claim the @scip-code scope on npm

npm versions are immutable — once 0.8.0 is published it can never be re-uploaded. And npm doesn't support "pending" trusted publishers, so the very first publish has to happen with an interactive login before trusted publishing can be configured.

1. Bootstrap publish from a maintainer's machine

cd bindings/typescript

# Materialize LICENSE exactly the way CI does
rm -f LICENSE && cp ../../LICENSE LICENSE

nix develop -c npm ci
nix develop -c npm run build

# Preview — verify dist/scip_pb.{js,d.ts,*.map} + package.json + LICENSE, nothing else (~31 kB packed)
nix develop -c npm publish --dry-run --access public

# Real publish — `npm login` opens a browser to authenticate as an owner of @scip-code
nix develop -c npm login
nix develop -c npm publish --access public

# Restore the symlink so the working tree stays clean
rm LICENSE && ln -s ../../LICENSE LICENSE

This seeds @scip-code/scip@0.8.0 and claims the package name for the scip-code org.

2. Configure the trusted publisher

On https://www.npmjs.com/package/@scip-code/scip/access → Trusted Publisher → Add Trusted Publisher:

Field	Value
Publisher	GitHub Actions
Organization	scip-code
Repository	scip
Workflow filename	release.yaml
Environment	(leave blank)

3. From the next release onwards

Trigger the release workflow from the Actions tab with the new version (e.g. 0.8.1). The publish-npm job authenticates via OIDC against the trusted publisher you just configured, publishes the package, and attaches a provenance statement — no long-lived secret involved.

[jupblb]

Published manually the first release: https://www.npmjs.com/package/@scip-code/scip