ci: restore JSR publishing via GitHub Actions OIDC

Triggers on v*.*.* tag push, verifies the tag matches package.json,
generates jsr.json from package.json and runs jsr publish via OIDC
trusted publishing (no token required).