ci(release): automate npm publishing

[WH-2099]

Summary

• Add a tag-triggered npm release workflow.
• Verify the release tag matches package.json and points to main.
• Check, build, pack, and publish the same tarball through the protected npm environment.
• Use least-privilege permissions and current rolling Action major tags.

Why

Publishing should be reproducible, reviewed, and performed by CI rather than a developer workstation.

Impact

The first release uses the NPM_TOKEN environment secret as a bootstrap credential.

After @mosoo/agent-driver exists, the token configuration will be removed and publishing will use OIDC Trusted Publishing.

Runtime code is unchanged.

Validation

• vp fmt --check .github/workflows/release.yml
• git diff --cached --check
• Confirmed every referenced Action uses its latest stable rolling major tag.

Closes #73

[Copilot]

Pull request overview

Adds protected, tag-triggered npm publishing for @mosoo/agent-driver.

Changes:

• Validates release tags against package.json and main.
• Checks, builds, packs, and publishes one artifact.
• Gates publishing through the npm environment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.