Publish audited Deixic SDK from public repo with npm OIDC

[haasonsaas]

Summary

Publish the Deixic TypeScript SDK from its public repository using npm trusted publishing. The release workflow runs on the repository's existing GitHub-hosted runner class, uses the exact public-repository identity in package metadata, and needs no long-lived npm publish token.

Every release builds and packs the package, audits the built tarball's files and embedded protobuf descriptor closure, publishes through OIDC, then downloads and audits the registry tarball and installs it in a clean project. The regular PR CI runs the same package audit.

Cause

The Mono release workflow's self-hosted runner cannot use npm trusted publishing, and its token fallback is expired. The public repository already uses GitHub-hosted CI and its package metadata identifies dx-corp/deixic-node, so the trusted publisher belongs here.

Verification

• actionlint .github/workflows/ci.yml .github/workflows/publish.yml passed.
• Built the projected package and audited its 21-file tarball: only deixicpublic/v1/sdk.proto, package deixicpublic.v1, with the timestamp import.
• A tarball with a second embedded descriptor was rejected by the audit.
• No package source files changed.

Rollout

After merge, configure npm trusted publisher for @evalops/deixic-sdk as dx-corp/deixic-node, workflow publish.yml, then dispatch version 0.1.7 from main and verify the registry integrity and clean install receipts.