ci: npm release via Trusted Publishing

[ronaldtse]

Summary

• replace the token-based publish (INTERSCRIPT_NPM_TOKEN exists but npm returns E404 on publish — the token cannot publish this name) with the org's proven Trusted Publishing workflow (same shape as interscript/api release.yml)
• v* tag or workflow_dispatch triggers; lint/format/build/test gate; publish with provenance; GitHub release notes

Test plan

• YAML parses
• after merge + npm Trusted Publisher configured for interscript-ts (interscript/interscript-ts + release.yml): tag v0.1.0 publishes