Set up npm publish in release workflow

[azeitler]

Summary

The release workflow (release.yml) is configured to publish to npm and build binaries, but it currently doesn't work end-to-end. Two issues need to be resolved.

Tasks

• npm access token — create an npm access token (automation type) at npmjs.com and add it as NPM_TOKEN in the repo's GitHub Actions secrets (Settings → Secrets and variables → Actions)
• Fix release workflow trigger — tags created by GITHUB_TOKEN (which release-please uses) don't trigger other workflows due to GitHub's anti-cascading protection. Options:
  • Option A: Chain the release jobs (binary builds + npm publish) directly into release-please.yml so they run in the same workflow after a release is created
  • Option B: Use a Personal Access Token (PAT) in release-please so the tag push triggers release.yml
• Test the full flow — merge a release PR and verify: npm publish succeeds, binaries are built for all 5 platforms, GitHub Release is created with attached artifacts

Context

After merging Release Please PR #3 (v0.2.0), the release workflow never triggered because the v0.2.0 tag was created by GITHUB_TOKEN. The package is not yet on npm (npm install -g s3pull returns 404).