ci(release): automate trusted core publishing

[Richardpwe]

What changed?

• Add a release workflow that validates every app/core release tag.
• Publish valid core-vX.Y.Z releases to npm with Trusted Publishing and OIDC.
• Check tag, package, lockfile, changelog, stable release type, and master ancestry before publishing.
• Pin Actions used by the OIDC workflow to full commit SHAs.
• Add tested release-tag validation for both app-vX.Y.Z and core-vX.Y.Z.
• Add a tracked release guide and update contributor and PR guidance.

Why?

Future core releases should publish to npm without a long-lived token. The tag convention also needs one public source of truth and automated checks.

Impact

This is repository infrastructure and maintainer documentation only, so it does not change the app or core package version. After merge, the npm package still needs the one-time Trusted Publisher link to publish-core.yml.

Checks

• npm ci
• npm run release:check
• 125 app unit tests
• 115 core unit tests
• 6 release-tag tests
• 9 Playwright tests
• production and full npm audits: 0 findings
• final lint and tag checks