fix(ci): npm-publish dry-run never took effect; document broken release auto-trigger

[verivus-open]

Summary

Two issues surfaced while cutting v2.6.0. This PR fixes the first (a clear, self-contained bug) and documents the second (needs a secret/decision — not implemented here).

1. Fixed: dry-run input never actually did a dry run

npm-publish.yml declares dry-run as type: boolean but the steps gated on inputs.dry-run == 'true' (a string). In GitHub expressions, comparing a boolean to a string coerces both to numbers: true == 'true' → 1 == NaN → false. So:

• Publish (dry run) (if: inputs.dry-run == 'true') was always skipped
• Publish (if: inputs.dry-run != 'true') was always run

Result: a workflow_dispatch with dry-run=true published for real. This actually happened during the v2.6.0 release (a "dry run" published llm-cli-gateway@2.6.0).

Fix: gate on the boolean directly — if: ${{ inputs.dry-run }} / if: ${{ !inputs.dry-run }}. On a release event inputs.dry-run is null (falsy), so the real publish runs and the dry-run step is skipped — unchanged intended behavior.

2. Documented (NOT fixed here): release → npm-publish auto-trigger is broken for workflow-created releases

release-tag-publish.yml's header says it "creates GitHub release (triggers npm-publish + release-installer)." That's false when the release is created by the workflow's GITHUB_TOKEN: GitHub does not let events authored by GITHUB_TOKEN (i.e. github-actions[bot]) trigger new workflow runs (recursion guard).

Evidence:

• Prior releases (v2.1.0–v2.5.0) auto-published because their GitHub Release was authored by the verivusOSS-releases user account (a PAT) — a user-authored release event does trigger npm-publish.yml.
• The v2.6.0 release was authored by github-actions[bot] (workflow GITHUB_TOKEN) → no trigger → had to dispatch npm-publish.yml manually.

Recommended fix (needs your decision):

• Option A — PAT: create a release PAT secret (fine-grained: contents+actions write) and use it for gh release create in release-tag-publish.yml, so the release event triggers npm-publish.yml (and release-installer.yml). Cleanest; matches the documented design. Only NPM_TOKEN exists today.
• Option B — explicit dispatch: same PAT, used to gh workflow run npm-publish.yml after creating the release (GITHUB_TOKEN can't dispatch either).
• Option C — fold-in: add the npm publish step (OIDC id-token: write) directly to release-tag-publish.yml; no new secret, but duplicates publish logic.

I didn't implement these because they need a secret you provision and/or an architecture call. Happy to add the chosen option as a follow-up commit to this PR.

Test

• dry-run fix is a pure conditional change; the required CI checks on this PR exercise it.