🔒 add provenance release workflow

[IsaacInsoll]

Summary

• add the permanent tag-triggered release.yml with isolated validation, npm, and GitHub Release permissions
• publish only the exact checked tarball; bootstrap 1.0.0-rc.0 with a temporary token and stage later versions through OIDC for npm 2FA approval
• keep staged GitHub Releases draft until a manual finalization run verifies the approved npm version and dist-tag
• validate annotated tags, package/changelog version alignment, registry visibility, and bootstrap latest absence

Verification

• npm run format:check
• npm run lint
• npm run typecheck
• npm run test:types
• npm test (75 tests)
• npm run test:consumer
• npm run package:check plus preserved-tarball inspection and SHA-512 transfer check
• CI=1 npm run test:browser:container (23 tests)
• npm run security:audit (root and packed consumer: 0 vulnerabilities)
• release.yml parsed with Ruby YAML

The combined local release:check reached the browser suite, where the existing Ctrl-click popup test flaked once under the local 8-worker mode; the release-equivalent single-worker CI rerun passed all 23 tests. Hosted CI remains the authoritative browser result for this PR.

After merge

No tag should be created yet. The npm-publish environment and temporary bootstrap secret must be configured before v1.0.0-rc.0; npm trusted publishing is configured only after that first package version exists.