ci: add PR check + autorel release workflows (npm OIDC)

[mhweiner]

Summary

• Mirrors brek's CI/CD setup onto ecswatch.
• .github/workflows/pr-check.yml — runs npm run validate on PRs to main.
• .github/workflows/release.yml — on push to main/next, runs validate then npx autorel@^2 to version, tag, changelog, and publish to npm via OIDC trusted publishing (no NPM_TOKEN).
• .autorel.yaml — same commit-type → release mapping and main/next branches as brek.
• package.json version set to 0.0.0-autorel (autorel-managed placeholder, like brek).

Deviations from brek (forced by ecswatch)

• pr-check + release use Node 24 (ecswatch engines requires >=24; brek's pr-check uses 22).
• Release runs npm run validate (= typecheck + build) instead of brek's build/lint/test/test:int — ecswatch has no lint/test scripts yet.

Required setup (before merge / first release works)

• Add npm Trusted Publisher for ecswatch: npmjs.com → package → Settings/Access → Trusted Publisher → GitHub Actions:
  • Organization/User: logfoxai
  • Repository: ecswatch
  • Workflow filename: release.yml
  • Environment: (leave empty)
• Confirm repo Actions have write permission (workflow declares contents: write + id-token: write; org settings must not block it).

Test plan

• PR check runs green on this PR.
• After merge, release.yml runs and publishes the next version to npm via OIDC.