feat: release workflow with npm trusted publishing

[paleo]

• Packages now publish from GitHub Actions through npm trusted publishing (OIDC), with a provenance attestation on every tarball. No npm token exists anywhere, and the local publish scripts are gone.
• Publication is confined to a release environment, so each release waits for one approval. Merges that publish nothing never request it.
• A release run maintains the release: version packages PR, publishes on approval, pushes git tags, creates the GitHub releases, then verifies the published signatures.
• New CI workflow: build, lint and test on Node 22 and 24 for every pull request and every push to main.
• Published manifests no longer carry a scripts field.
• docs/releasing.md documents the release flow, provenance verification, binding management and the owner setup.
• Changesets upgraded to v3, and all dependencies moved to their latest versions.

Owner setup — done

Trusted publishers are registered for the 8 packages, the release environment exists (reviewer paleo, deployments restricted to main), and "Allow GitHub Actions to create and approve pull requests" is enabled. The release run is ready to approve.

Registration requires npm CLI ≥ 11.19, so the publish job pins npm@11.19.0 — earlier versions omit the permissions field the registry now requires.

Remaining, after the first successful CI release: enable "Require two-factor authentication and disallow tokens" for each package on npmjs.com.