build: switch package build to tsdown

[ts-76]

Summary

• switch the package build from tsc to tsdown and update published entry metadata
• split release creation and tag publish flow to avoid accidental patch bumps on rerun
• switch npm publishing to trusted publishing for packages that require MFA/passkeys

Verification

• bun run build
• bun run test
• bun run lint

Notes

• npm Trusted Publisher registration for this repository/workflow must exist before merge, or the publish job will still fail