Publish from CI with npm provenance

Releases are currently published from a laptop. Move to a tag-triggered GitHub Actions workflow with [npm provenance](https://docs.npmjs.com/generating-provenance-statements):

- `release.yml`: on tag `v*` → full gate (build/typecheck/test/attw) → `pnpm -r publish --access public --provenance --no-git-checks`
- `id-token: write` permission + `NPM_TOKEN` secret (granular, publish-only)
- Document the release flow in CONTRIBUTING.md

Create the tag-triggered workflow in release.yml and update CONTRIBUTING.md with the release flow. Start by reviewing the existing build, typecheck, test, and attw commands, then configure the full gate, npm provenance, id-token permission, and NPM_TOKEN secret for publishing. Done means a v* tag runs the gate and publishes packages with the documented process.

Written by the indexing model from the issue text.