ci: stage npm release for maintainer approval

[tarikjabiri]

Summary

Switches CD to npm staged publishing, matching the stage-only Trusted Publisher configured on @tarikjabiri/dxf. The previous direct npm publish was rejected with OIDC permission denied because the trusted publisher grants "npm stage publish" only (npm's default for configs created after 2026-09-03).

• CI runs npm stage publish (instead of npm publish) — submits a staged release via OIDC, no token
• actions/setup-node (Node 22 ≥ 22.14.0) + npm install -g npm@latest (≥ 11.15.0) satisfy the staged-publishing requirements
• bun still handles install/test/build

Release flow after this merges

1. Trigger CD (release published, or Actions → CD → Run workflow → main) → creates a staged release.
2. A maintainer approves it with 2FA:
   • CLI: npm stage list → npm stage approve <stage-id>, or
   • npmjs.com → package → Staged Packages tab → Approve.
3. The version goes live only after approval.

Notes

• Keeps the security posture you chose: no stored token, and a human 2FA gate before anything goes live.
• Provenance (--provenance) was dropped from the command since staged publish flags differ; can be revisited once confirmed supported by npm stage publish.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.29%. Comparing base (1c502c8) to head (4b810d2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #198   +/-   ##
=======================================
  Coverage   81.29%   81.29%           
=======================================
  Files          78       78           
  Lines        2790     2790           
  Branches      223      223           
=======================================
  Hits         2268     2268           
  Misses        476      476           
  Partials       46       46           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.