ci: npm 自动发版（Trusted Publishing）——npmjs 配好发布者后推 v* tag 即发，发布前跑计数与 lint 闸门

.github/workflows/release.yml

@@ -0,0 +1,31 @@
+# npm 发布——Trusted Publishing（与 agency-orchestrator 同款）：
+# 需先在 npmjs.com 给包 agency-agents-zh 配 GitHub Actions 发布者
+# （org: jnMetaCode / repo: agency-agents-zh / workflow: release.yml / environment 留空，
+#   Allowed actions 勾 "Allow npm publish"），之后推 v* tag 即自动发版，无需 OTP/token。
+name: Release (npm)
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write # Trusted Publishing 取 OIDC token 必需，自动附带 provenance
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@latest
+      - name: Verify counts & lint
+        run: |
+          node scripts/check-counts.mjs
+          bash scripts/lint-agents.sh
+      - name: Publish to npm
+        run: npm publish --access public