fix: prepare npm trusted publishing workflow

[vmvarela]

Summary

• checkout source and use Node 24/npm OIDC-compatible client
• stage dotfiles, root LICENSE, and six release artifacts before publishing
• inject tag version into the placeholder package version
• publish failures fail CI; job skips only unless NPM_TRUSTED_PUBLISHING=true
• normalize npm repository metadata

Validation

• YAML parse
• simulated artifact staging and npm pack --dry-run (launcher, LICENSE, six binaries)