[CI] Publish NPM Package on GitHub Release

[rasulkireev]

Summary

• Add a GitHub Actions workflow that publishes @readwise/cli to npm when a GitHub Release is published.
• Add workflow_dispatch support with a required tag input, so maintainers can manually publish a specific release tag.
• Gate publishing on the selected tag matching v${package.json.version} and the lockfile versions matching package.json.
• Add package repository metadata required for npm provenance/trusted publishing.

Release safety

The workflow refuses to publish when:

• the GitHub Release is marked as a prerelease
• the selected tag does not match v${package.json.version}
• package-lock.json is out of sync with package.json
• the selected tag does not point at a commit on origin/master
• the version is already published or older than npm latest

Manual publish

Use Run workflow and provide a tag like v0.5.7. The workflow checks out that tag and applies the same version guards before publishing.

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/publish-npm.yml"); puts "workflow yaml parses"'
• npm run build
• npm pack --dry-run

Setup required after merge

Configure npm Trusted Publishing for @readwise/cli with:

• Publisher: GitHub Actions
• Repository: readwiseio/readwise-cli
• Workflow filename: publish-npm.yml
• Environment name: npm-publish
• Allowed action: npm publish