feat(sdk/ts): publish @nvidia/openshell-sdk to the public npm registry

User Story

As an OpenShell SDK consumer,
I want to install @nvidia/openshell-sdk from the public npm registry (npmjs.com),
so that I can use it without configuring a custom .npmrc scope or providing a GITHUB_TOKEN with read:packages permission.

Problem Statement

The TypeScript SDK (@nvidia/openshell-sdk) is currently published exclusively to GitHub Packages. Consumers must configure the @nvidia scope to point at https://npm.pkg.github.com and authenticate with a GitHub personal access token that has read:packages scope. This is a friction barrier for every new consumer and every CI pipeline that depends on the SDK.

Impact / Why This Matters

Without this feature, users must:

1. Create or obtain a GitHub personal access token with read:packages scope.
2. Add a project-level .npmrc with @nvidia:registry=https://npm.pkg.github.com and an //npm.pkg.github.com/:_authToken= line (or use npm login --registry).
3. Manage token rotation and ensure CI environments have the token available as a secret.

This results in:

• Onboarding friction: New SDK consumers hit an auth wall before they can run npm install. The default npm install @nvidia/openshell-sdk fails without configuration.
• CI complexity: Every CI pipeline consuming the SDK needs a GitHub token secret wired in, even when the package is public and open-source.
• Ecosystem discoverability: The package does not appear on npmjs.com search, reducing visibility to the broader Node.js community.
• Inconsistency: The Python SDK is published to PyPI (the public registry for Python); the TypeScript SDK should follow the same pattern for its ecosystem.

This matters because reducing installation friction directly affects SDK adoption.

Proposed Design

1. Configure the @nvidia/openshell-sdk package as a trusted publisher on npmjs.com, linking it to the NVIDIA/OpenShell GitHub repository and the release workflow. This uses npm Trusted Publishers (OIDC) — the workflow authenticates via GitHub Actions' OIDC identity provider, so no long-lived npm token or repository secret is needed.
2. Update publishConfig.registry in sdk/typescript/package.json from https://npm.pkg.github.com to https://registry.npmjs.org.
3. Update the release CI workflow (.github/workflows/release-tag.yml) to:
   • Request an OIDC token from GitHub Actions (permissions: id-token: write).
   • Use the id-token to authenticate with npmjs.com via the trusted publisher flow (e.g., npm publish --provenance).
   • The --provenance flag attaches a Sigstore attestation, tying each published version to its source commit and workflow run.
4. Update sdk/typescript/README.md to remove the .npmrc / GitHub token instructions and replace with a plain npm install @nvidia/openshell-sdk.
5. Optionally, continue publishing to GitHub Packages as a secondary registry for consumers who prefer it.

From the user's perspective, the install experience becomes:

npm install @nvidia/openshell-sdk

No .npmrc, no token, no scope configuration.

Acceptance Criteria

• npm install @nvidia/openshell-sdk works from the public npm registry without any .npmrc overrides or authentication
• The @nvidia/openshell-sdk package is registered as a trusted publisher on npmjs.com, linked to the NVIDIA/OpenShell repository and release workflow
• The release workflow publishes tagged versions to npmjs.com using OIDC authentication (no long-lived npm token secret)
• Published versions include Sigstore provenance attestations (--provenance)
• sdk/typescript/README.md install instructions reflect the public registry
• The package is discoverable on https://www.npmjs.com/package/@nvidia/openshell-sdk

Alternatives Considered

• Keep GitHub Packages only. This is the status quo. It works for internal consumers who already have GitHub tokens but creates unnecessary friction for the open-source community.
• Use a long-lived npm access token as a repository secret. This works but requires manual token rotation, is less secure than OIDC, and does not produce provenance attestations. Trusted Publishers is the npm-recommended approach for GitHub Actions.
• Publish to both registries. This preserves backward compatibility for existing consumers using GitHub Packages while making the public registry the default. Viable but adds CI complexity for marginal benefit — once npmjs.com is available, the GitHub Packages path becomes redundant.

Start by reviewing sdk/typescript/package.json, .github/workflows/release-tag.yml, and sdk/typescript/README.md to trace the current registry and release configuration. Verify the npm trusted publisher setup and tagged release flow, then confirm that npm install @nvidia/openshell-sdk works without authentication and published versions include provenance.