Fix npm trusted publishing release workflow

[konard]

Fixes #56

Summary

• Replace the split deploy.yml and test.yml setup with one .github/workflows/release.yml that matches the npm trusted publisher configuration.
• Always run the Node/Bun/Deno test matrix before any release decision; only the npm publish step is skipped when the exact version already exists.
• Switch npm publishing from secrets.NPM_TOKEN to GitHub OIDC trusted publishing with id-token: write, Node 24, npm ^11.5.1, and npm publish --access public --provenance.
• Normalize npm metadata so publish no longer auto-corrects bin.use or repository.url; the existing Unlicense package metadata will publish with 8.13.8.
• Add tests/release-workflow-policy.test.mjs to prevent regressions in workflow filename, token-free publishing, action versions, job timeouts, Deno retry behavior, and npm metadata.
• Retry the Deno CI command for transient esm.sh 522 failures while preserving the final failure status if all attempts fail.
• Add the requested issue case study, screenshot, template comparison artifacts, CI logs, local repro logs, and verification logs under docs/case-studies/issue-56.

Verification

• npm test -- tests/release-workflow-policy.test.mjs --runInBand
• npm test -- --runInBand (38 suites, 257 tests)
• bun test (257 tests)
• deno test --allow-net --allow-env --allow-run --allow-read --allow-write --allow-sys (24 modules, 128 steps)
• npm publish --dry-run --access public
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "yaml_ok"'

Evidence

• Case study: https://github.com/link-foundation/use-m/blob/issue-56-fe0c27a4113b/docs/case-studies/issue-56/README.md
• Issue screenshot artifact: https://github.com/link-foundation/use-m/blob/issue-56-fe0c27a4113b/docs/case-studies/issue-56/assets/issue-56-screenshot.png?raw=true
• First PR validation failure log captured for the Ubuntu Deno esm.sh 522 failure: https://github.com/link-foundation/use-m/blob/issue-56-fe0c27a4113b/docs/case-studies/issue-56/ci-logs/pr-run-27417997956.log

Notes

• The publish job is intentionally gated to github.ref == 'refs/heads/main' and github.event_name == 'push', so PR CI validates the workflow and tests without attempting an npm publish.
• GitHub still labels the branch workflow as Create Release on Tagged Commit in parts of the Actions UI because the path .github/workflows/release.yml existed with that older workflow name, but this branch's workflow file is named CI/CD and the jobs are from the new release.yml.
• npm run test:examples was probed but is not used as a release gate because it runs published use-m@latest examples and depends on the examples harness resolving zx through its shebang, which does not validate this branch's unpublished changes.

[konard]

Working session summary

Implemented and pushed the fix to PR #57: #57

What changed:

• Consolidated CI/CD into .github/workflows/release.yml.
• Switched npm publishing to OIDC trusted publishing with id-token: write and npm publish --access public --provenance.
• Removed the split deploy.yml / test.yml setup.
• Normalized npm metadata for Unlicense, repository.url, and bin.use.
• Added a release workflow policy test.
• Added the requested case study, CI logs, screenshot, template comparisons, and repro evidence under docs/case-studies/issue-56.
• Added a Deno CI retry loop after the first PR run exposed transient esm.sh 522 failures on Ubuntu.

Verification:

• Local npm test -- --runInBand: passed, 38 suites / 257 tests.
• Local bun test: passed, 257 tests.
• Local Deno suite: passed, 24 modules / 128 steps.
• npm publish --dry-run --access public: passed.
• Latest PR CI run 27418512248: passed all six matrix jobs; publish skipped as expected for PRs.

PR #57 is now marked ready for review, merge state is clean, and the working tree is clean.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.5
• Provider: OpenAI
• Public pricing estimate: $16.831863

📊 Context and tokens usage:

• 756.2K / 1.1M (72%) input tokens, 45.8K / 128K (36%) output tokens

Total: (756.2K + 7.2M cached) input tokens, 45.8K output tokens, $16.831863 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.5
• Model: GPT-5.5 (gpt-5.5)

📎 Log file uploaded as Repository (44986KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• All CI checks have passed
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag