ci(theme): add guarded trusted release workflow

[aeei]

Summary

• add a manual-only release workflow for @aeei/docusaurus-theme
• require protected theme-release environment approval plus exact version/confirmation input
• use npm trusted publishing through GitHub OIDC; no long-lived npm token
• build and validate only the AEEI theme and docs starter before publish
• tag successful source as theme-vX.Y.Z
• keep Deck's repository-owned tarball as the primary distribution boundary

Safety

• no push trigger
• main branch only
• existing-version and existing-tag preflight
• upstream/Lerna package publish commands forbidden by contract test
• packed 0.1.10 artifact remains unchanged: 447a7290c3a49ab208098be23cf350c2663fe7459692a1fa329761e10f399cf1

Validation

• Jest release/config/legal contracts
• theme build
• npm pack hash comparison
• focused Prettier
• git diff --check

Required npm configuration

Before first dispatch, configure npm trusted publishing for:

• package: @aeei/docusaurus-theme
• repository: aeei/docusaurus-theme
• workflow: theme-release.yml
• environment: theme-release