Add npm auto-publish workflow

[runninyeti]

Mirrors the jiti publish pipeline: on push to main → test → auto-bump patch version (skipped if manually bumped) → commit version back → publish to npm.

Differences from jiti's version:

• Uses GITHUB_TOKEN (contents: write) for the version-bump push instead of a DEPLOY_KEY secret — no secret setup needed.
• Publishes under two names: @indexing-co/cli and @indexing/cli (same tarball, renamed via npm pkg set for the second publish).
• Auth via npm trusted publishing (OIDC, id-token: write) — no npm token stored in the repo.

⚠️ Do not merge until both packages exist on npm and each has a Trusted Publisher configured (package Settings → Trusted Publisher → GitHub Actions, repo indexing-co/indexing-co-cli, workflow publish.yml) — otherwise the publish steps fail on every push to main.