fix: gate npm publish on CI success and release-version bump

[htnabe]

Summary

• gate npm publish behind the successful main-branch test workflow
• require a real version bump before publishing to npm
• auto-select npm dist tags for beta/rc/next and align docs with the release flow

Validation

• npm test

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Updates the repository’s release/publish pipeline by switching npm publishing to run only after successful main CI completion, adding a version-bump gate to avoid duplicate publishes, and aligning publishing documentation with the updated release flow.

Changes:

• Switch .github/workflows/publish.yml to trigger from workflow_run of the main test workflow and add a release/version gate plus prerelease dist-tag mapping.
• Refresh dependencies and bump the package version to 0.0.16 in the lockfile.
• Update publishing documentation to reflect CI-gated publishing and prerelease channel tagging.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

File	Description
package-lock.json	Bumps package version and updates dependency lock to match new release/tooling versions.
docs/development/publishing.md	Documents the new “CI-first on main” publish flow and dist-tag behavior.
.github/workflows/publish.yml	Reworks publishing trigger/gating to run after successful main CI and auto-select dist-tags for prereleases.

Suppressed comments (1)

docs/development/publishing.md:155

• The troubleshooting checklist implies a publish can happen with only a package-lock.json version bump, but the publish gate compares the version from package.json. This item should mention bumping package.json (and keeping the lockfile in sync) to match the workflow behavior.

- Was the `main` branch push a deliberate version bump in `package.json` or `package-lock.json`?
- Did the required CI checks pass on the merge commit before the publish workflow started?

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.