Automate npm releases with trusted publishing

[rathesDot]

Lets an agent (or anyone) release a new version by merging a version-bump PR, with no npm token stored anywhere.

Changes

• .github/workflows/release.yml: runs on pushes to main that touch package.json (and manually via workflow_dispatch). If the version in package.json isn't on npm yet, it installs, runs the tests, publishes with npm publish --provenance --access public (authenticated via npm trusted publishing / OIDC) and creates the vX.Y.Z GitHub release with generated notes. Otherwise it does nothing, so dependency bumps don't publish anything.
• package.json: repository, bugs and homepage now point at learn-tamil/script instead of learn-tamil/tamil-script. npm rejects provenance when repository.url doesn't match the publishing repo.
• CLAUDE.md: the release recipe for agents. Bump with npm version <level> --no-git-tag-version, open a Release X.Y.Z PR, merge when green, then verify the workflow run and the GitHub release.

Required before the first release

On npmjs.com, open the @learn-tamil/script settings, go to Trusted Publisher, choose GitHub Actions, and enter organization learn-tamil, repository script, workflow release.yml.

Testing

• actionlint and Prettier pass on the new files. pnpm test, pnpm eslint and tsc --noEmit pass.
• npm pack --dry-run builds lib/ through prepack as expected.
• Checked the version-check logic against the registry: 0.8.0 is found and 0.8.1 is not. Merging this PR therefore runs the workflow, which skips because 0.8.0 is already published.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SUZwZNHq5MTwxkdGyJg6Sn

---

Generated by Claude Code