CI + npm publish

[llbbl]

Tasks

• GitHub Actions: build + test on push/PR; pandoc-gated integration tests skip cleanly when pandoc is absent.
• Release workflow: publish to npm (public), version via tag; ESM.
• (optional) Docker image bundling pandoc for zero-setup consumers.

Acceptance: CI is green; a tagged release publishes the package.

Depends on: "Package scaffold (TS library)"

[llbbl]

Closed by the successful 0.1.1 release.

@llbbl/polydoc-core@0.1.1 published through release.yml via OIDC trusted publishing — no npm token is stored in repo secrets. Verified on the registry:

• dist-tags.latest = 0.1.1
• provenance attestation present (https://slsa.dev/provenance/v1)
• GitHub Release created automatically from the CHANGELOG section: https://github.com/agentic-tooling/polydoc-core/releases/tag/v0.1.1

The first run failed at the Pack step and was fixed in #26 — npm pack --silent still prints the prepack lifecycle banner, so capturing its stdout produced a multi-line value that $GITHUB_OUTPUT rejected. Worth recording that the failure ordering held: it died before npm publish, so nothing shipped and the version was not burned. The tag was re-cut on the fixed commit, since a tag-triggered workflow runs from the tag's own commit.

The optional Docker image bundling pandoc from this issue's task list was not built. Filing separately if it's still wanted.