feat: add trusted publishing release pipeline

[BoldBlackBot]

Summary

Adds a fully automated release pipeline using npm OIDC trusted publishing, following the same design as the harness repo (projects:harness:design:release-pipeline on the corkboard).

What changes

• New workflow tag-on-merge.yml: fires on push to main when the commit message starts with release v. Tags the release, publishes to npm via OIDC trusted publishing (with provenance attestations), and creates the GitHub release — all in one workflow. No npm tokens or PATs stored in GitHub secrets.
• Rewritten release skill: migrated from the manual model (agent runs npm publish with OTP, pushes tags, creates releases) to the PR-based model (agent opens a release PR from the BoldBlackBot fork, maintainer squash-merges, CI handles the rest). Also migrates the skill from jj to git.

Trust model

• Trust boundary: "can merge a PR to main" = "can release"
• Agent role: opens release PR from fork (BoldBlackBot), monitors CI (read-only)
• Maintainer role: reviews and squash-merges the PR
• No npm credentials stored in GitHub secrets. No PATs. OIDC handles npm auth at publish time.

One-time setup (manual, after merge)

Configure the trusted publisher on npmjs.com for @boldblackai/create-bclaw under Settings → Trusted Publisher → GitHub Actions: org=boldblackai, repo=create-bclaw, workflow filename=tag-on-merge.yml.

Test Plan

• actionlint passes on the new workflow
• pnpm lint passes
• pnpm format:check passes
• pnpm exec tsc --noEmit passes
• pnpm test (17 golden tests) passes
• CI passes on this PR
• After merge: configure npm trusted publisher, then cut a release to verify the end-to-end pipeline