ci: add publish script with provenance, with --dry-run for now

.github/workflows/publish.yml

@@ -0,0 +1,31 @@
+name: Publish Package to npmjs
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch: # 👈 allows you to trigger manually from the Actions tab
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24.x'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: browser build
+        run: npm run build-browser
+
+      - name: Dry run publish with provenance
+        run: npm publish --provenance --access public