Publish the npm package via GitHub Actions

npm is introducing stricter security requirements for package publishing.

In particular:

- npm is deprecating TOTP-based 2FA in favor of WebAuthn/passkeys. This includes physical FIDO2 security keys as well as supported platform authenticators such as Touch ID, Face ID, or Windows Hello. See [npm's security changes announcement](https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/).
- Classic npm tokens have already been revoked.
- Granular access tokens configured to bypass 2FA are also being restricted, and npm is targeting **January 2027** for removing their ability to publish packages directly. See [npm's announcement about the deprecation of bypass-2FA tokens](https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/).
- For automated publishing, npm recommends migrating to **Trusted Publishing using OIDC**. GitHub Actions and GitLab CI/CD are supported providers. See the [npm Trusted Publishing documentation](https://docs.npmjs.com/trusted-publishers/).

We should therefore set up **GitHub Actions to publish new versions of `formol` to npm using Trusted Publishing**.

## Requirements

- Add a GitHub Actions workflow using npm Trusted Publishing / OIDC.
- The workflow must be triggered **manually** (`workflow_dispatch`) for now; no automatic publishing on tags, merges, or releases.
- Only repository members with **write access** should be able to trigger the workflow. GitHub requires write access to manually run a `workflow_dispatch` workflow. See the [GitHub documentation on manually running workflows](https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manually-run-a-workflow).
- Restrict publishing to the appropriate branch (e.g. `main`).
- Document the complete release and publishing procedure in the README so maintainers know how to publish a new version.