ci(sdk): publish the JavaScript SDK to npm via trusted publishing

[rmyndharis]

@rmyndharis/openwa was the only SDK with no release automation at all. Version 0.1.0 reached npm from a laptop in June and nothing has published it since, which is why it still reads 0.1.0 while the Java SDK — the one with a release workflow — is on 0.1.1.

Change

A tag-triggered publish workflow modelled on java-sdk-release.yml, using npm Trusted Publishing (OIDC).

There is no npm token in the workflow or in repository secrets. npm mints a short-lived credential from the GitHub OIDC token and attaches build provenance automatically, so nothing long-lived exists to leak or rotate. That also keeps this path out of npm's token programme rather than subject to it: classic tokens were revoked in December 2025, granular write tokens are now capped at 90 days, and 2FA-bypass tokens lose direct publish in January 2027. Trusted publishing is the stated migration target for all three.

Details worth noting for review:

• npm is upgraded before publishing. Trusted publishing needs npm >= 11.5.1, which is newer than the npm bundled with Node 22. Without the upgrade the run fails by looking for a token, which reads as a credentials problem rather than a version one.
• No --provenance flag. npm attaches provenance on its own for a trusted-publisher release; passing it would be redundant.
• Guards run before anything is built. workflow_dispatch is restricted to the same js-sdk-v* tag shape a push triggers on, so an arbitrary branch or a monorepo v* app tag cannot reach npm, and the tag version must match package.json. Both are textual, matching the Java release's approach.
• The publish runs the SDK's own gates first — test, typecheck, build, and the dual CJS/ESM smoke check — so the tarball that reaches npm is the one those gates passed, not a later rebuild.

One-time setup required before the first tag

The npmjs.com side cannot be automated. On the package settings for @rmyndharis/openwa, add a Trusted Publisher: GitHub Actions, organization rmyndharis, repository OpenWA, workflow filename js-sdk-release.yml. Until that exists npm rejects the publish. Documented in sdk/javascript/README.md -> Releasing.

No repository secrets are needed.

Note on the other SDKs

For context, the current state across all five: Java publishes to Maven Central on a java-sdk-v* tag and is at 0.1.1; PHP is mirrored to its own repository on every push to main; Python is on PyPI at 0.1.0 with no workflow (still manual); Go needs no publish step but has no semantic version tag, so consumers resolve a pseudo-version. Only the JavaScript gap is addressed here.