Prepare manual npm Trusted Publishing with OIDC

[gitdamnit]

What changes

• Publish only on manual workflow dispatch; never on GitHub release or tag push.
• Require a stable release tag and verify it matches package.json.
• Check out that exact tag so publication never accidentally uses the current default branch.
• Use GitHub-hosted Node 24, npm 11, and OIDC (id-token: write) instead of permanent NPM_TOKEN credentials.
• Preserve existing build/test checks before publishing.

Safety / approval

This PR does not publish anything. Do not run the manual publishing workflow until the npm package's Trusted Publisher has been configured for this exact GitHub repository and publish.yml, and the maintainer separately approves publishing. For @gitdamnit/stranger-danger (not yet on npm), an initial authenticated bootstrap publication is required before npm will let us establish trust.

Review

Confirm workflows pass GitHub YAML/action validation, source tag is the released artifact, and npm ownership / OIDC prerequisites are satisfied before merge.