ci: release publish workflow, PR-title validation, and commit conventions

[nujovich]

What

Bundles the release automation (Fase 4) and the guardrails that keep the auto-generated changelog clean.

Changes

• .github/workflows/publish.yml — publishes to npm on v* tags via OIDC trusted publishing (no NPM_TOKEN secret) with build provenance. Verifies the tag matches package.json version before publishing.
• .github/workflows/pr-title.yml — validates PR titles are Conventional Commits. Since PRs are squash-merged, the PR title becomes the changelog entry; commitlint only checks local commits, so this closes that gap.
• CONTRIBUTING.md — documents that PR titles must be conventional, that CHANGELOG.md is never hand-edited (generated at release time), and that pushing a tag auto-publishes to npm via CI.

Repo setting (applied, not part of the diff)

Merges are now squash-only (merge-commit and rebase disabled), so each PR lands as one conventional commit → one clean changelog entry.

Required setup on npmjs.com (one-time, before the next tag)

mint-ds package → Settings → Trusted Publisher → add a GitHub Actions publisher:

• Repository: nujovich/mint
• Workflow filename: publish.yml

Without this, the publish step fails with an auth error. No repo secret needed.

Testing

• publish.yml runs only on tag push — first real exercise is the next release tag after the trusted publisher is configured.
• pr-title.yml runs on this PR and validates its own (conventional) title.
• YAML validated locally; CI green (format/lint/typecheck/test/build).