setup script

[danielroe]

handles initial setup of an unpublished package by publishing a stub of needed

maybe uses github device flow oauth plus configuring github environments, then runs npm trust commands to configure trusted publishing for the package and restrict token usage