chore(workflows): consolidate npm publishing into single-source version.yml

[namastex888]

Consolidating all npm publishing logic into version.yml utilizing OIDC, eliminating redundant publish actions in CI and Release workflows to resolve publish failures.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9863eaf8-c286-4f72-9160-03004aa7f931

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/single-npm-publisher

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23ada501a7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep npm publish in release hotfix/manual path

After this change, the Release job ends immediately after gh release create, so manual runs (or any run where Resolve version derives a hotfix tag) now create a GitHub release without publishing the matching npm version. This is a regression from the previous workflow behavior and can leave v<version> tags discoverable in GitHub with no corresponding package on npm. version.yml does not backfill this path because its manual trigger publishes from dev (branch || 'dev') and its main publish path is gated to CI workflow_run merge commits from /dev.

Useful? React with 👍 / 👎.