feat(ci) Add automated npm publishing

[TheodoreSpeaks]

Summary

• publish sim-skills after every merge to main
• derive the first or next stable version from npm and synchronize both plugin manifests
• validate, test, typecheck, lint, build, and inspect the packed artifact before publishing
• document the release behavior

Validation

• 13 tests passed
• skill validation passed for all five skills
• typecheck, lint, build, and package smoke test passed
• real registry lookup resolved the unpublished package to 0.1.0

Required before merge

Add an Actions repository secret named NPM_TOKEN with publish permission for sim-skills. The repository currently has no Actions secrets, so the release job will fail fast at authentication until this is configured.