ci(release): restore alpha publishing and docs deployment [Codex]

[jderochervlk]

Context

The CI workflow combined verification, npm publishing, and documentation deployment under workflow-level write permissions, while package versions and installation guidance used the experimental channel. Publishing also depended on a repository secret instead of npm trusted publishing.

This restores main-branch releases through a dedicated job and keeps write permissions scoped to the jobs that require them.

Changes

• keep validation, documentation generation, and package creation in the build job using Node.js 24
• upload the packed tarball as an artifact, then download and publish it from a main-branch-only release job with OIDC access
• publish commit-specific prereleases with the alpha suffix and npm dist-tag
• scope GitHub Pages permissions to the documentation deployment job
• update README and documentation badges, install commands, and generated version metadata to use the alpha channel