ci: single-workflow Friday train (train.yml)

[vreshch]

Summary

• Replace release-train.yml + release.yml with a single canonical train.yml (Friday Train v2 spec)
• Fully automated: dependabot merge -> internal @chemistry/* bump (ncu) -> version decide -> verify -> commit+tag to master -> OIDC publish -> npm-serves assert + GH release
• No NPM_TOKEN (OIDC trusted publishing), no release PRs, direct commits to master
• cron 0 20 * * 5 (L1 slot, unchanged from release-train.yml)

Test plan

• npm run verify green in worktree (type-check, lint, format:check, test, build)
• npx prettier --check .github/workflows/train.yml green
• all 9 embedded run: | bash blocks pass bash -n
• action-validator clean on train.yml
• CI checks green on this PR
• post-merge dispatch smoke test (bump=auto bump_deps=false) expected green "skip" path (publish trusted-publishing not yet configured - expected per spec phase 3 note)

[github-actions]

🎉 PR Validation ✅ PASSED

Commit: a58dbaca1fd6c777e0f7185b7836c9a10e072353
Branch: feature/train-v2

Checks:

• ✅ Dependencies installed
• ✅ Type check passed
• ✅ Linting passed
• ✅ Format check passed
• ✅ Tests passed
• ✅ Build successful

Ready to merge! ✨

---

🔗 View workflow run
⏰ Generated at: 2026-08-10T21:02:53.615Z