Add npm release automation

[konojunya]

背景

The Cloudflare build for stack-sh/web currently rebuilds the Rust engine because @stack-sh/engine has not been published. Publishing the existing validated browser package first lets consumers install an immutable npm artifact without a Rust toolchain.

実装方法

• Add a GitHub Release workflow for @stack-sh/engine.
• Rebuild and validate the WASM package from the tagged merged revision before publication.
• Require the release tag, workspace version, and package version to match.
• Require the tagged commit to be contained in main.
• Publish public scoped releases through npm trusted publishing with GitHub Actions OIDC and automatic provenance.
• Skip publication when the exact version already exists, allowing the manually bootstrapped first release to have a matching GitHub Release.
• Document the one-time first publish and exact trusted-publisher configuration.

テスト方法

• npm run build:wasm
• npm test
• npm run typecheck
• npm run pack:check
• cargo +stable fmt --check
• actionlint .github/workflows/release.yaml

Review 視点 / 懸念点

• @stack-sh/engine does not exist on npm yet, so version 0.1.0 requires one authenticated manual publish before OIDC can be configured for subsequent releases.
• No npm token is stored in GitHub or the repository.
• Publishing remains an explicit GitHub Release action; this PR does not publish a package by itself.