[codex] Add GitHub Actions CI and publish workflows

[ejntaylor]

Summary

• Adds a CI workflow for pull requests, main pushes, and manual runs.
• Validates on Node 18, 20, and 22 with install, typecheck, tests, build, committed dist verification, and package dry run.
• Adds a production dependency audit job with npm audit --omit=dev --audit-level=moderate.
• Adds a release-driven npm publish workflow using provenance and a release-tag/package-version guard.
• Documents the release process and npm trusted publishing requirement in the README.

Notes

This PR is based on main and intentionally only contains CI/CD workflow changes plus release documentation. The publish workflow assumes npm trusted publishing is configured for this repository and package before a GitHub Release is published.

Validation

• npm test
• npm run typecheck
• npm run build
• git diff --exit-code -- dist
• npm audit --omit=dev --audit-level=moderate
• npm pack --dry-run
• Release tag guard checked locally with GITHUB_REF_NAME=v0.1.0