Set up npm trusted publishing as @ultracart/bigquery-sdk

[ucjonathan]

What

Prepares this package for npm trusted publishing (OIDC) as @ultracart/bigquery-sdk and for the repo going public. Mirrors the existing @ultracart/bq-skill setup.

Changes

File	Change
package.json	name → @ultracart/bigquery-sdk; added repository/homepage/bugs, engines.node, a files allowlist, and publishConfig (access public + provenance)
.github/workflows/publish.yml	new — publishes on v* tags via OIDC trusted publishing, protected npm environment, SHA-pinned actions, tag/version match check, npm test gate, npm publish --provenance --access public
README.md	fixed broken PLAN.md link; updated install/require to the scoped name; status → early release
docs/EXTRACTION.md, examples/README.md, src/client.js	install/require snippets → scoped name
CHANGELOG.md	cut [0.1.0]
test/schema-drift.test.js	split fake paths on both separators so offline tests pass on Windows too (Linux CI was already green)

Verification

• npm test → 20/20 pass
• npm pack --dry-run → tarball contains only src/ + README/LICENSE/CHANGELOG (no tests/scripts/examples)
• Secret/PII scan of tree + git history → clean

Remaining manual steps (after merge)

Trusted publishing requires the package to exist on npm before a trusted publisher can be configured, so:

1. Bootstrap publish a placeholder 0.0.1 from local (npm publish --access public) so the first real 0.1.0 can go through CI with provenance.
2. Create a protected GitHub Environment named npm (with required reviewers).
3. Add the trusted publisher on the npm package's access page (this repo + publish.yml + environment npm).
4. Tag v0.1.0 → CI publishes with provenance.
5. Make the repo public.

🤖 Generated with Claude Code