ci: automate secure npm releases

[Upd4ting]

Summary

• add a manual latest/next release workflow using release-it and npm Trusted Publishing
• harden CI with pinned actions, Node 24, frozen installs, and conventional PR titles
• enable npm provenance and skip token-based npm prechecks for OIDC
• run the interface unit suite directly with Mocha, avoiding the active core provider that currently makes the test harness ambiguous
• include unit and package-consumer tests in every release

Validation

• 75 unit tests passed
• package-consumer tarball test passed
• release-it stable dry-run proposed 0.0.13 with npm tag latest
• release-it next dry-run proposed 0.0.13-next.0 with npm tag next
• workflow YAML and release configuration parsed successfully

No package was published.