Add npm trusted publishing workflow

[dannysauer]

Summary

• add an npm publishing workflow for @herodevs/eol-shared
• authenticate to npm through GitHub OIDC instead of a long-lived token
• create an empty-body GitHub Release for the verified tag after npm publishing succeeds
• isolate GitHub Release creation in a least-privilege job with contents: write
• pin GitHub Actions to the immutable commits for v7.0.0
• add .tool-versions with Node.js 24.14.1 and have setup-node consume it
• keep dependency caching disabled in the privileged publishing job
• validate linting, formatting, types, tests, and build output for source release tags
• replace the placeholder 1.0.0 package version with the v-prefixed release tag version before publishing
• support manually publishing an existing prebuilt release tag, including v0.1.23

Bootstrap

The initial @herodevs/eol-shared@0.1.22 package has been published manually. Before the first workflow publish:

1. Configure the package's npm trusted publisher for GitHub organization herodevs, repository eol-shared, workflow npm-publish.yml, with npm publish permission.
2. Confirm the trusted publisher is saved before pushing a new release tag or manually dispatching this workflow for the existing v0.1.23 tag.

Historical release-build tags do not contain .tool-versions. The workflow restores that file from the default branch before setup-node reads it, so the manual v0.1.23 path and future source tags use the same pinned Node version.

Validation

• actionlint .github/workflows/npm-publish.yml
• npm ci
• npm run lint
• npm run format:check
• npm run type-check
• npm test (200 passing)
• npm run build
• simulated the manual v0.1.23 path against the actual signed release tag
• npm pack --dry-run produced @herodevs/eol-shared@0.1.23 with the expected 39 files
• verified gh release create uses the existing remote tag and receives explicit empty notes

npm ci reports four existing dependency audit findings; this PR does not change dependencies.

[dannysauer]

infrabot ffmerge

[dannysauer]

No infrabot? Well, that's sad.