[woss]

Problem

Release PR #42 (0.7.2) merged, tag v0.7.2 + GitHub release + JSR all landed — but npm publish never ran. publish-npm failed with:

npm error code ENEEDAUTH
``` (run `39772796614`). Same failure in the 0.7.1 Release Please run (`39342535445`); 0.7.1 only reached npm because it was manually re-dispatched as `workflow_dispatch` (`39345202777`).

## Root cause

npm trusted publishing (OIDC, no token secret) does not work when `release.yml` runs via `workflow_call` — the OIDC identity doesn't match what npm's trusted publisher expects. Pattern across all runs:

| Publish | Invocation | Result |
|---|---|---|
| 0.6.0 | workflow_dispatch | ✅ |
| 0.7.0 | tag-push | ✅ |
| 0.7.1 (rel-please) | workflow_call | ❌ ENEEDAUTH |
| 0.7.1 (manual rerun) | workflow_dispatch | ✅ |
| 0.7.2 (rel-please) | workflow_call | ❌ ENEEDAUTH |

## Fix

- `release-please.yml`: replace the `uses: ./.github/workflows/release.yml` job with a `gh workflow run release.yml` dispatch step (`actions: write`). Dispatched runs are direct runs → trusted publishing works.
- `release.yml`: drop the now-unused `workflow_call` trigger.

## Verification

- Both YAMLs parse.
- The exact mechanism (direct dispatch of `release.yml` with `tag_name=v0.7.2`) is exercised to publish 0.7.2 to npm — the failed `workflow_call` path is never used again.

---
🤖 Created by omp (session `01a16aa5-5882-7603-aaf6-7ea7811d7815`)