Adds release.yml: on v* tags (or dispatch on a tag ref), verifies the
tag matches package.json, builds, lints, tests, then publishes with
OIDC — no NPM_TOKEN secret, provenance attached automatically.

The weekly update workflow now tags its version bump and dispatches
the release workflow (GITHUB_TOKEN tag pushes cannot trigger workflows
directly), so npm tracks main automatically. README documents the npm
install path alongside github:#main.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>