feat: add trusted npm publishing

[TrickRiggin]

What changed

• add a tag-triggered npm publishing workflow using GitHub OIDC
• require the release tag to match the package version before publishing
• bump the npm package and PowerShell module together to 0.3.1
• document the release procedure
• replace the hard-coded version test with a durable format check while retaining npm/module equality validation

Why

Future releases should use short-lived trusted-publisher credentials instead of storing or passing a long-lived npm write token. The 0.3.1 release will prove the configured npm trust relationship end to end.

Validation

• pwsh -NoProfile -File ./tests/Test-AgentGuidanceSync.ps1 - 16 passed
• npm pack --dry-run - 9 intended files in the 0.3.1 tarball
• git diff --check