- Publishes to npm whenever a GitHub Release is published
- Uses npm Trusted Publishing (OIDC) so no NPM_TOKEN secret is required
- Stable tags (vX.Y.Z) go to the latest dist-tag and commit the version
bump back to master; pre-release tags (vX.Y.Z-beta.N) publish to a
matching dist-tag without touching master
