Fix npm publish workflow provenance for tag releases

[Copilot]

The publish GitHub Actions job was failing during npm publish with a Sigstore provenance validation error: Missing SourceRepositoryRef in signing certificate. The failure was caused by publishing from the release event context rather than from the version tag ref npm trusted publishing expects.

• Root cause

  • release.published did not provide a usable tag ref in the provenance certificate.
  • npm rejected the generated bundle with E422 because SourceRepositoryRef was missing.

• Workflow change

  • Switched the publish trigger from release.published to version tag pushes (v*).
  • Kept the existing publish job structure intact; only the event source changed.

• Documentation alignment

  • Updated the workflow header comment to reflect tag-driven publishing behavior.

on:
  push:
    tags: ['v*']
  workflow_dispatch: