ci: streamline checks and release artifacts

[WH-2099]

Summary

• Replace the justfile workflow with concise package scripts and one strict check.
• Simplify pull request CI to run the unified check.
• Build npm and OCI artifacts once, then publish them independently to npm and GHCR.
• Add OCI metadata, version/latest image tags, and least-privilege job permissions.
• Protect release-sensitive files with CODEOWNERS and align documentation and runtime configuration.

Why

The project no longer needs a second task runner.

Checks, builds, and publishing should have one clear path without repeating work across CI jobs.

Impact

Pull requests no longer build container images.

Version tags produce one npm package and one OCI image, with npm publishing gated by the npm environment.

The image is published with the package version and latest tags.

Validation

• vp run check
• 1074 tests passed.
• 19 live-provider tests skipped as expected.
• Formatting, linting, type checking, and build completed successfully.
• The release-only Buildah image build was not run locally.

Closes #75

[Copilot]

Pull request overview

Streamlines project checks and release automation while centralizing commands in package scripts.

Changes:

• Replaces Just tasks with unified package scripts.
• Simplifies PR checks and separates npm/GHCR publishing.
• Adds OCI metadata, CODEOWNERS, and aligned documentation.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package.json	Centralizes build and validation scripts.
justfile	Removes the secondary task runner.
.github/workflows/pr.yml	Runs the unified PR check.
.github/workflows/release.yml	Builds and publishes reusable release artifacts.
.github/CODEOWNERS	Protects release-sensitive files.
Containerfile	Uses the explicit Codex package name.
src/runtimes/openai/app-server-client.ts	Uses explicit Codex runtime constants.
tests/driver-artifact-contract.test.ts	Updates the image script contract.
README.md	Documents the new commands.
.env.example	Updates live-test instructions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.