Add tag-driven npm release workflow (trusted publishing)

.github/workflows/release-crypto.yml

@@ -0,0 +1,45 @@
+# Publishes @pksuite/crypto to npm via OIDC trusted publishing when a
+# crypto-v* tag is pushed. No npm token is stored anywhere: npmjs.com must
+# list this repo + workflow file as the package's Trusted Publisher
+# (package Settings → Trusted Publisher → GitHub Actions →
+# repository ddyy/pk, workflow release-crypto.yml). With trusted
+# publishing, provenance attestations are generated automatically and
+# publishConfig.provenance takes effect.
+name: Release @pksuite/crypto
+on:
+  push:
+    tags: ["crypto-v*"]
+
+permissions:
+  contents: read
+  id-token: write # OIDC token for npm trusted publishing
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.33.0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+      - run: pnpm install --frozen-lockfile
+      # Full suite, not just the package: pkvault integration is part of
+      # the release bar, same as CI.
+      - run: pnpm test
+      - name: Verify tag matches package version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#crypto-v}"
+          PKG_VERSION="$(node -p "require('./packages/crypto/package.json').version")"
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "tag $TAG_VERSION does not match package.json $PKG_VERSION" >&2
+            exit 1
+          fi
+      # OIDC trusted publishing requires npm >= 11.5.1; runners ship older.
+      - run: npm install -g npm@latest
+      - run: npm publish
+        working-directory: packages/crypto