fix: publish npm from main push

[ngocdevv]

Summary

• trigger npm Trusted Publishing from a push to main instead of pull_request_target
• recover the merged PR associated with github.sha
• preserve the allowlisted reviewer/merger authorization gate and fail closed for direct or ambiguous pushes
• keep publishing expo-share-content@0.1.1, which remains unpublished

Root cause

npm Trusted Publishing signed provenance successfully but rejected token exchange/publish with E404 from pull_request_target. This matches npm CLI issue #8739; OIDC publication works from a push event.

Verification

• actionlint .github/workflows/publish-npm.yml — passed
• YAML trigger validation — passed
• real GitHub API fixture: PR fix: publish npm tarball from local path #8 merge SHA resolves to exactly one PR and allowlisted merger
• real direct-push SHA fixture resolves to zero PRs and fails closed
• 40/40 Jest tests, lint, build, and CommonJS verification — passed
• expo-share-content@0.1.1 is still available on npm