release: move npm publication to trusted publishing

[Hmbown]

Problem

The v0.9.5 release completed GitHub, GHCR, Homebrew, CNB, website, and all 20 Cargo crates noninteractively, but the final codewhale@0.9.5 npm wrapper is still gated on a maintainer browser login plus security-key/2FA approval. The workstation npm credentials had expired (npm whoami returned E401), and the official web login correctly required physical WebAuthn approval.

This makes the npm package the only release channel that cannot be reproduced and completed by the protected exact-tag workflow.

Desired behavior

• configure npm Trusted Publishing/OIDC for the codewhale package and a tightly scoped GitHub Actions workflow
• bind publication to an immutable vX.Y.Z tag that is reachable from protected main
• require the successful exact-SHA GitHub Release asset freshness gate before npm publication
• retain provenance and fail closed on version/tag/package drift
• keep a documented manual recovery path without long-lived bypass-2FA tokens
• add workflow-contract tests so a branch, dirty candidate, missing assets, or mismatched binary version cannot publish

v0.9.5 evidence

• package assets/prepublish gate: green for all 34 v0.9.5 release assets
• npm whoami: E401 Unauthorized after the local session expired
• npm official web login: authenticated account hmbown, blocked awaiting physical security-key approval

This issue tracks eliminating the recurring human release bottleneck; it does not weaken npm 2FA.