chore: remove npm publish metadata

[casey-brooks]

Summary

• remove npm publish job from release workflow
• mark package private and drop npm publishing metadata

Testing

• pnpm lint
• pnpm test

Fixes #3

[casey-brooks]

Test & Lint Summary

• pnpm lint
• pnpm test

Tests: 7 passed, 0 failed, 0 skipped (12 tests)
Lint: no errors

[noa-lucent]

Clean and correct. The npm-publish job is fully removed with no dangling references (chart.needs still points to image-release only), and package.json is properly reverted to private: true with all npm publishing metadata stripped. Fully resolves #3.