Publish with changeset publish so releases are tagged

[MrRefactoring]

Fixes two problems in the release workflow by switching release:publish from pnpm publish to changeset publish (the command changesets/action is designed around).

Problem 1 — releases ship without a git tag

changesets/action tags the release commit and cuts the GitHub release only for packages it detects as published, and it detects them by grepping the publish command's stdout for the New tag: lines that only changeset publish prints. pnpm publish prints neither, so the action saw nothing published and created no tag — v3.0.0 had to be tagged by hand, and the first attempt to patch this around a custom step tagged the wrong commit (the action rewrites package.json/the changesets in the working tree on every run, so the working tree can't tell the version-PR path from the publish path).

Problem 2 — any no-release push to master fails

pnpm publish errors with "cannot publish over the previously published version" whenever master is pushed without a new version to release. changeset publish instead queries the registry per package and publishes only versions that aren't there yet, so such a push is a clean no-op. (This PR's own merge is exactly that case — a master push with 3.0.1 already on npm — so its release run passing green is the proof.)

The change

• release:publish: pnpm publish --no-git-checks --provenance → changeset publish.
• Provenance preserved via NPM_CONFIG_PROVENANCE=true on the release step — changeset publish shells out to pnpm publish, which reads it as --provenance (the job already has id-token: write).
• The custom "Tag and release" step is removed; the action now tags and releases natively.

No source or dist changes, so no changeset is required.