[panyam]

What changes

• Problem: notations is published by hand from a laptop, with no provenance and no check that the tag matches package.json.
• Change: .github/workflows/publish-npm.yml publishes on a v* tag through servicekit's shared npm-publish.yml, using npm trusted publishing, so there's no token to store.
• The shared job installs with pnpm, builds, runs check:esm, lint and pnpm test, refuses a tarball with *.test.* files, checks the tag against package.json, and skips a version already on npm.
• Note: package.json and tag v1.1.0 say 1.1.0, but npm's latest is 1.0.9, so 1.1.0 was never published. The v1.1.0 tag predates this workflow, so it can't publish it; the next tag (or a manual npm publish) will.

Reviewer's guide

• Think of a shared mail room: servicekit runs the publishing steps, and the parcel still carries this repo's return address, because npm's trusted publisher names this repo's publish-npm.yml.
• So the one file here only says which package manager to use and which checks to run.

Read: .github/workflows/publish-npm.yml.

Risk / blast radius

• Needs ci: shared publish workflow reads npm 12's pack --json; pnpm support servicekit#40 merged first (pnpm support and the npm 12 fix in the shared workflow).
• Nothing publishes until the npm side is set once: npx npm@latest trust github notations --repo panyam/notations --file publish-npm.yml --allow-publish.
• Not exercised until the next v* tag. npm publish by hand still works.
• Checked locally on a clean worktree: pnpm install --frozen-lockfile --ignore-scripts, npm run build and check:esm, lint and pnpm test all pass, and the tarball has no test files.