ci: add GitHub Actions verification and npm release automation

[NgoQuocViet2001]

Summary

• add a CI workflow that runs build, tests, release guards, npm pack, and isolated install/doctor smoke checks on PRs and main
• add a Release workflow that reacts to v*.*.* tag pushes, re-runs verification, publishes to npm with provenance via trusted publishing, and creates the matching GitHub Release
• keep the release trigger file name stable as release.yml so it can be wired to npm trusted publishing with npm trust github

Why

This lets future releases publish from GitHub Actions without needing npm auth on a local machine, while still guarding the package with the same checks we run manually.

One-time npm setup after merge

npm trust github codex-keyring --repo NgoQuocViet2001/codex-keyring --file release.yml -y

Future release flow

1. Update versioned files and changelog.
2. Commit and create the version tag.
3. Push with git push origin main --follow-tags.
4. GitHub Actions publishes to npm and creates the GitHub Release automatically.

[NgoQuocViet2001]

I pushed a follow-up fix to this branch. The failing CI root cause was that the workflows called npm run release:verify, but that script was missing from package.json on this branch. I added the missing release:verify, prepack, and prepublishOnly scripts and re-ran the local verification path (release:verify, npm pack, isolated install, and doctor). GitHub Actions should rerun automatically on the new commit.

[NgoQuocViet2001]

Merged after fixing the CI regression. The failing checks were caused by the workflows calling npm run release:verify before that script had been added on this branch; I restored the missing release scripts, re-ran the local verification path, and waited for all three GitHub Actions jobs to pass before merging.