ci: add manual release preparation and trusted npm publishing

[Coderrob]

Description

Add release preparation and npm publishing modeled on Coderrob/typescript-ast, adapted to this repository's VS Code extension and existing VSIX release workflow.

• Prepare Release (workflow_dispatch, main only): choose major/minor/revision (patch), bump manifest and lockfile versions, promote nonempty Unreleased notes into a dated changelog section, validate the candidate, and open a release PR.
• Publish To npm: publish on exact stable release tags or manually dispatch from main with an existing tag. Require tag/version/lockfile/changelog agreement and a commit reachable from main, then rerun release validation and publish with npm trusted publishing (OIDC).
• Use Node.js 24 for release jobs. Serialize preparation and publishing runs. Keep publishing permissions limited to contents read and OIDC token issuance.
• Add npm package allowlisting in .npmignore and verify exact nonempty packed contents. Preserve the existing .vscodeignore: VSCE rejects combining it with package.json files.
• Add offline release-helper tests and npm package verification to the three-platform CI matrix, plus release setup/runbook documentation.

The npm artifact remains the VS Code extension bundle and requires its extension host. Package identity remains barrel-roll; no library or CLI interface is introduced.

Validation

• npm run release:verify: quality checks, type checking, all 354 extension tests, per-file coverage, memory retention, production build, and npm pack verification
• Five offline release automation tests
• CLI smoke test of npm version bump, changelog promotion, matching-tag acceptance, and legacy-tag rejection in a temporary fixture
• actionlint on both new workflows and the updated CI workflow
• vsce ls: exactly LICENSE, package.json, README.md, dist/extension.js, and public/img/barrel-roll-icon.png
• npm run lint and npm package verification rerun after final packaging adjustments

Setup before publishing

Configure npm trusted publishing for owner Coderrob, repository barrel-roll, workflow publish-npm.yml, no environment, with direct npm publish allowed. Initial package publication/setup and npm name ownership are prerequisites. The registry has unpublished historical barrel-roll versions through 1.1.7; choose an unused version.

Enable Actions PR creation for the default GITHUB_TOKEN, or configure the optional RELEASE_PR_TOKEN secret with contents and pull-request write access. Use that optional token when branch rules require automatic PR CI, since GITHUB_TOKEN-created PRs do not trigger PR workflows.

No release workflow has been dispatched and no package has been published by this PR.