ci: add npm publish workflow with OIDC trusted publishing

Publishes @vacbo/opencode-nia-plugin on git tag push (v*).

- Uses npm Trusted Publishing (OIDC) — no NPM_TOKEN required
- Validates tag matches package.json version before building
- Clean rebuild with stale-file guard (catches Phase 4-style regressions)
- --provenance flag uploads signed SLSA attestation
- workflow_dispatch with dry_run input for manual testing