CLOUDPLAT-3217: add npm publish workflow

[haseebehsan]

Jira: CLOUDPLAT-3217

Changes

• .github/workflows/npm-release.yml: New workflow_dispatch workflow that publishes to npm and creates a GitHub release.
• package.json: Added publishConfig: { access: "public" } for the scoped package. Bumped version to 9.4.2.
• CONTRIBUTING.md: Documents the release process — bump version, update CHANGELOG, merge PR, trigger workflow from Actions.

Note

This PR is blocked on mapbox/gha-public being made public. The reusable workflow referenced in npm-release.yml will not be accessible to this repo until gha-public is a public repository.

[ox-security]

Successfully scanned changes introduced in a pull request into master from CLOUDPLAT-3217-oidc-npm-publish.

Internal scan identifier: f653eff0-8842-4352-b6dd-5002c68a74dc.

Total issues	Blocking issues	Scan status
1	0	✔️

Category	Issues
CI/CD Posture	1

See all issues found during this scan in the OX Security Application.

Detailed information

Issue #	1
Name	Unpinned Reusable Workflow • GitHub Actions
Status	New
Enforcement	Monitor
Severity	High
Category	CI/CD Posture
Source tools	OX CI/CD Posture
Recommendation	Pin reusable workflows to a full-length commit SHA (40 characters) instead of a tag or branch. Example: uses: org/repo/.github/workflows/build.yml@a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0

1 aggregation

File	Match
.github/workflows/npm-release.yml	uses: mapbox/gha-public/.github/workflows/workflow-npm-oidc-publish.yml@main

[haseebehsan]

closing in favor or automatically created PR #170