ci: release without anyone running a release - #7

Mirrors ai-forms#16 so both libraries release identically.

Cutting a release meant `npm version && git push --tags` by hand. Now merging a
version bump to main ships the package: the workflow asks the registry whether
package.json's version already exists and publishes it if not.

That check rather than a tag trigger, because a tag pushed by GITHUB_TOKEN does
not start another workflow — "push a tag, let publish.yml notice" silently never
runs — and because asking npm what is published is idempotent, so a re-run or a
hand-pushed tag cannot double-publish. The tag is created after a successful
publish, so it never claims a release that did not happen.

NPM_TOKEN expires 2026-11-14. token-health.yml probes `npm whoami` weekly and
opens a single issue when it fails, with the fix in it — rather than letting a
release three months from now be the thing that discovers the expiry, reported
as a 403 that reads like a permissions problem.

Verified: both files parse, and the registry check answers correctly against the
real registry for threadkit@0.1.0 (already published → skip).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>