ci: simplify publish auth flow

[bntvllnt]

Summary

• remove PAT-based release mutation from the publish workflow
• align release flow with the simpler ui-style model
• update README release docs to match the actual workflow

Changes

• remove workflow_dispatch bump input
• stop bumping and committing package.json inside the release workflow
• remove secrets.RELEASE_PAT dependency from checkout
• add a tag-exists guard before release tagging
• keep npm publishing on OIDC with provenance
• document the new flow in README.md

Release model after this PR

• version bump happens in a normal PR to main
• canary publishes on pushes to main
• release workflow is manually dispatched
• release job reads current package version, tags it, publishes via OIDC, and creates a GitHub release

Validation

• pnpm lint
• pnpm typecheck
• pnpm build
• pnpm test