ci: publish releases with semantic-release

[viceice]

Changes

Adds the release job to the build workflow: semantic-release publishes to npm with trusted publishing once lint and test pass on main. Branch pushes run it as a dry run.

• Publishing goes through @containerbase/semantic-release-pnpm, like in containerbase/base, instead of @semantic-release/exec commands.
• Unlike containerbase/eslint-plugin, there's no global npm update step: pnpm v12 handles trusted publishing itself.

The package now exists on npm (a dummy 0.0.0-PLACEHOLDER was published by hand), so trusted publishing could be set up for it.

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Claude Opus 5.5 (Claude Code) copied the release job from containerbase/eslint-plugin, guided and reviewed by @viceice.

Use of AI in replying to PR comments

Who answers review comments:

• @viceice will read and reply directly. Name the account.
• An agent will draft replies and @username will read them before they are posted. Name the account.
• An agent will draft replies and reply autonomously. This is heavily discouraged, and we prefer that there are humans in the loop
• Nobody has explicitly committed to replying.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified tests

🤖 Generated with Claude Code