ci: add automated prerelease publishing

[kauandotnet]

Summary

• align the repository with nestm-dev/better-auth on pnpm 11.18.0, Node 22/24 CI, and exact shared tool versions
• add Changesets prerelease management for the alpha channel
• add tokenless npm Trusted Publishing through GitHub OIDC, with required provenance
• add package validation, Nest canary/peer smoke checks, manual preview publishing, and Dependabot
• document the one-time npm bootstrap and trusted-publisher handoff

Verification

• pnpm install --frozen-lockfile
• pnpm run check
• pnpm run test (16 unit + 5 E2E)
• pnpm run verify:pack
• pnpm dlx @arethetypeswrong/cli --pack . --profile esm-only
• actionlint
• pnpm audit --audit-level high --prod
• simulated pnpm changeset version in an isolated worktree (0.1.0-alpha.0 → 0.1.0-alpha.1)

One-time maintainer handoff

After this PR is merged, 0.1.0-alpha.0 must be published interactively once because npm does not allow configuring a trusted publisher for a package that does not exist. Then bind @nestm/nestjs-standard-schema to release.yml / the release environment. Subsequent releases require no npm token.