[release] npm publish pipeline (trusted publishing) for 0.1.0

[rowkav09]

Stand up the npm publish workflow modelled on ghostdeps .github/workflows/release.yml (OIDC trusted publishing, provenance, dry-run rehearsal before any real tag).

BLOCKED on me: npm trusted-publisher setup for the spec2mcp package (same shape as ghost-deps, which is already configured and verified). Do not cut any release without his explicit go - rehearsals only until then.

Done when: the workflow rehearses green on workflow_dispatch; a real publish happens only on his tag.

[rowkav09]

Repo-side plumbing merged in #25: publish.yml (trusted publishing + provenance, test-gated), CHANGELOG.md, RELEASING.md. Remaining: npm-side trusted publisher for rowkavdev/spec2mcp pointing at .github/workflows/publish.yml - Rowan's setup on npmjs.com.