Automate npm publishing from version tags

[maotora]

Summary

• trigger npm publish automatically when a v* tag is pushed
• keep manual publish as a fallback, but only when run from main
• require the tag to match the package.json version and point to a commit reachable from main
• skip publishing if that package version already exists on npm
• fail early with a clear error when NPM_TOKEN is missing

Verification

• YAML parse check for .github/workflows/publish.yml

Follow-up

• add the NPM_TOKEN repository secret if it is not configured yet
• publish a release by bumping package.json, merging to main, then pushing a matching tag such as v0.2.1