chore: adopt the release checklist and authenticate publishes with OIDC

[robrigo]

Why

The v2.2.0 tag reached npm with no GitHub Release, and its publish run failed because the workflow expected an npm token that was never provisioned. This PR makes the Release part of every release and switches publish auth to npm trusted publishing: RELEASING.md carries the checklist and the body template, scripts/release-notes.sh composes the Release body from the CHANGELOG entry, scripts/packaging.test.sh proves the tarball in CI, and publish.yml holds no token, only the OIDC id-token npm exchanges. Package metadata fills out to the published-page field set, and the tarball keeps src for source-map resolution while dropping test sources.

Validation

scripts/release-notes.test.sh passed 12/12, scripts/packaging.test.sh passed 8/8 (tarball 119 files, the four test sources gone), and yarn test reports 35 passing, unchanged from main. Both workflows parse. The trusted-publishing path itself runs at the next tag; the npm-side setting for @atomichub/vert is already configured.

The matching change to the internal release standard rides in FACINGS/atomichub#6401.

[Copilot]

Pull request overview

This PR formalizes the project’s release process by introducing a release checklist and automating GitHub Release body generation from CHANGELOG.md, while also switching npm publishing to OIDC-based trusted publishing (no long-lived token).

Changes:

• Add RELEASING.md and new scripts to generate/test GitHub Release notes and to validate the npm tarball contents in CI.
• Update GitHub Actions workflows: publish via OIDC + provenance, and extend CI to run packaging and release-notes checks.
• Improve npm package metadata (exports, keywords, publishConfig.provenance, files exclusions) and align README/CHANGELOG with the new release flow.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
scripts/release-notes.sh	Generates a GitHub Release body from the CHANGELOG + commit range + compare link.
scripts/release-notes.test.sh	Adds a hermetic git-fixture test verifying release-notes behavior across tag scenarios.
scripts/packaging.test.sh	Adds an npm pack dry-run verifier to ensure the published tarball contents are correct.
RELEASING.md	Introduces a standardized release checklist and Release body template aligned to the scripts/workflows.
README.md	Updates package branding and adds install instructions/badges for the new npm package identity.
package.json	Adds publish metadata (exports, keywords, publishConfig.provenance, files exclusions, author object).
CHANGELOG.md	Adds a 2.2.0 entry in the expected format for Release body composition.
.github/workflows/publish.yml	Switches npm publish auth to OIDC trusted publishing and adds version/tag verification.
.github/workflows/ci.yml	Adds packaging verification and a dedicated release-notes script test job.

Suppressed comments (1)

.github/workflows/publish.yml:34

• The publish workflow upgrades npm with npm@latest, which makes releases non-reproducible and can introduce breaking behavior unexpectedly (the comment only requires >= 11.5.1 for OIDC). Consider pinning to a specific known-good npm version (or at least a bounded range like npm@^11.5.1) so publish behavior is deterministic across tags.

      - name: Upgrade npm
        # Trusted publishing (OIDC) needs npm >= 11.5.1; the Node 22 image
        # ships npm 10.x.
        run: npm install -g npm@latest

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[robrigo]

On the suppressed npm@latest note: kept as latest deliberately. Every sibling publish workflow in the org uses npm@latest, OIDC needs a current npm, and an exact pin goes stale between releases. Version pinning across the publish fleet is queued as a separate hardening pass.