Rewrite CI for npm publish

[NoNamer777]

Question

Rewrite this repo's CI/CD to build/test/publish the library instead of the app/Docker image, using the mechanics found in "Research npm Trusted Publishing + staged publishing" (#4):

• .github/workflows/release-publish.yml: replace the promote-image job (Docker Hub login + docker buildx imagetools create) with the npm Trusted Publishing + staged-publish flow.
• Remove the Docker-only composite action .github/actions/sign-and-push-tag/action.yml (confirm it's actually Docker-specific and not also used by the tag-signing step in release-prepare.yml before removing it). find-image-version and remove-image were already removed in "Remove app-runtime scaffolding" (Remove app-runtime scaffolding #3), along with the docker/e2e jobs in pull-request.yml/push-main.yml/release-publish.yml, pull-request-closed.yml, and the detect-relevant-changes composite action.
• release-prepare.yml's version-bump/changelog/tag mechanics are registry-agnostic, expected to carry over largely as-is; verify against the final library project layout from "Scaffold the Angular library project" (Scaffold the Angular library project #2).
• Update .github/actions/ci/action.yml and .github/actions/prepare-workspace/action.yml to reflect the library's build/lint/test/typecheck pipeline (the Docker-specific steps in ci/action.yml were already dropped in Remove app-runtime scaffolding #3).

Resolved by research (no remaining open question, this ticket is execution): CI is publish-and-forget via npm stage publish (no 2FA, doesn't block on approval, a human approves later via 2FA, separately). Use job-scoped permissions: { id-token: write, contents: read }, npm CLI >= 11.15.0, Node >= 22.14.0, actions/setup-node with registry-url: https://registry.npmjs.org; no NPM_TOKEN secret needed. Double check whether release-publish.yml runs directly vs via workflow_call/workflow_dispatch, npm's Trusted Publisher validation checks the calling workflow's name in the latter case, which affects what filename gets registered in "Configure the npm Trusted Publisher link". Full detail on the research/npm-trusted-publishing branch: docs/research/npm-trusted-publishing.md.