ci: auto-publish to ClawHub on version bump

[arberx]

Summary

• Extend the publish workflow so a version bump on main also publishes the skills/aeo skill to ClawHub, keeping it in lockstep with npm.
• Authenticates via a new CLAWHUB_TOKEN repo secret passed through an env: block (no direct ${{ }} interpolation in run:), pins the CLI to clawhub@0 per CLAUDE.md supply-chain rules, and derives --changelog from the head commit subject.

Test plan

• Add CLAWHUB_TOKEN secret in repo settings
• Merge a version-bump PR to main and verify both npm and ClawHub are updated in one workflow run

🤖 Generated with Claude Code