ci(publish): add tag-driven npm publish workflow

- add .github/workflows/publish.yml triggered by <npm-name>@<version> tags
- verify tag matches package.json name and version before publishing
- run check and test before publishing with npm provenance
- pin pnpm via packageManager field for pnpm/action-setup
- document the release flow in both READMEs

package.json

@@ -9,6 +9,7 @@
     "publish:packages": "pnpm -r publish --no-git-checks"
   },
   "type": "module",
+  "packageManager": "pnpm@11.25.0",
   "private": true,
   "dependencies": {
     "@gotgenes/pi-permission-system": "^32.0.2"