feat(ci): add release.yml — tag-push triggers npm publish + GH release

Adopts the rig-bridge release-spine pattern:

- Fires on v* tag push
- Tag-vs-package.json version match gate
- npm ci -> audit (critical) -> build -> test -> built-CLI version smoke
- npm publish --provenance --access public (uses NPM_TOKEN secret + id-token: write)
- gh release create with --generate-notes and --verify-tag

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mcp-tool-shop

.github/workflows/release.yml

@@ -0,0 +1,77 @@
+name: Release
+
+# Fires on git tags shaped like v1.0.0, v1.0.1, v1.1.0, etc.
+# - Builds + verifies (tests).
+# - Publishes to npm with --provenance (uses NPM_TOKEN secret).
+# - Creates a GitHub Release with auto-generated notes.
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+-*'   # pre-release tags (e.g. v1.0.0-rc.1)
+
+permissions:
+  contents: write     # needed to create the GitHub Release
+  id-token: write     # needed for npm --provenance attestation
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0      # fetch tags + history so gh release notes can compute since-last-tag
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Verify tag matches package.json version
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          if [ "$TAG" != "$PKG_VERSION" ]; then
+            echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $PKG_VERSION"
+            exit 1
+          fi
+          echo "Tag and package.json version match: $PKG_VERSION"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit dependencies
+        run: npm audit --audit-level=critical
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm test
+
+      - name: Built-CLI smoke
+        run: |
+          BUILT_VERSION=$(node dist/cli.js --version)
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          if [ "$BUILT_VERSION" != "$PKG_VERSION" ]; then
+            echo "::error::Built CLI version $BUILT_VERSION does not match package.json $PKG_VERSION"
+            exit 1
+          fi
+          echo "CLI version smoke: $BUILT_VERSION"
+
+      - name: Publish to npm (with provenance)
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            --title "$GITHUB_REF_NAME" \
+            --generate-notes \
+            --verify-tag