Add trusted npm publishing for the DocPull SDK

[zacharyr0th]

What changed

• add a tag/manual npm publish workflow for @raintree-technology/docpull-sdk
• require version matching, locked install, tests, typecheck, build, provenance, and a registry install smoke
• document npm trusted-publisher setup and release verification

Why

The SDK is public, but future releases had no repository workflow. This keeps npm credentials out of GitHub and makes the Python and TypeScript packages release from the same version tag.

Checks

• bun install --frozen-lockfile
• bun run --cwd sdk/js test (14 passed)
• bun run --cwd sdk/js typecheck
• bun run --cwd sdk/js build
• npm pack --dry-run
• YAML parse
• git diff --check