feat(ci): trusted-publish workflows for miner + ui-kit, rename mcp workflow

[JSONbored]

Summary

• Adds packages/gittensory-miner and packages/gittensory-ui-kit to the release-please-managed, OIDC trusted-publishing pipeline that packages/gittensory-mcp and packages/gittensory-engine already had — these two packages have never had CI publish automation before now.
• New workflows (publish-miner.yml, publish-ui-kit.yml) mirror publish-engine.yml's exact validate/publish/github-release shape: unprivileged validate job packs + smoke-tests the tarball with no id-token, privileged publish job (behind the environment: release approval gate) downloads that exact tarball and publishes via OIDC with provenance. Per-package adaptations:
  • miner ships hand-written checked-in JS (node --check syntax validation, no tsc build) with two bin entries; validate reuses the existing test:miner-pack allowlist check, then smoke-tests both installed bins' --help output.
  • ui-kit builds via tsc like engine; validate typechecks, then smoke-tests by importing the built dist/utils.js and calling its pure cn()/relativeTimeFromNow() exports (no React render needed).
• release-please-config.json/.release-please-manifest.json gain entries for both new components (miner-v*/ui-kit-v* tags, matching the mcp-v*/engine-v* convention already in place), and mcp-release-please.yml dispatches both new workflows on release, syncs package-lock.json for all four components, and is retitled from "MCP/Engine Release Please" to "Package Release Please" to reflect the broader scope.
• Also renames npm-publish.yml → publish-mcp.yml for naming consistency with the other three, updating every internal reference: the release-please dispatch, the three sibling workflows' own header comments, and the MCP release-candidate tooling (check-mcp-release-candidate.mjs, mcp-release-core.mjs, mcp-release-candidate-core.mjs, their test) that hardcoded the old path.

Unrelated drift fixed along the way

apps/gittensory-ui/src/lib/mcp-package.ts's MCP_PACKAGE_KNOWN_LATEST_VERSION constant was stale at "0.7.0" against the actually-published "0.7.1", caught by this PR's own gate (ui:version-audit) — bumped to match, per the file's own documented invariant (never ahead of npm, always equal after a real publish).

npm-side state

All four packages (@loopover/engine, @loopover/mcp, @loopover/miner, @loopover/ui-kit) have already been bootstrap-published to npm from an authenticated maintainer session and have their Trusted Publisher configured in npmjs.com's package settings, pointing at these exact workflow filenames — this PR is what makes those configurations actually resolve to real files on main.

Test plan

• Full local gate (npm run test:ci + npm audit --audit-level=moderate) green.
• Verified both new workflows' validate-job logic end-to-end locally before writing the YAML: typecheck/build, pack, file-list check, install into a scratch dir, and run the actual smoke-test assertions — both passed, including miner's tarball correctly resolving @loopover/engine as a real dependency from the live npm registry.
• actionlint clean across all workflow changes.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.00%. Comparing base (7e55ebc) to head (f677fe1).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5609   +/-   ##
=======================================
  Coverage   95.00%   95.00%           
=======================================
  Files         573      573           
  Lines       45629    45629           
  Branches    14661    14661           
=======================================
  Hits        43350    43350           
  Misses       1528     1528           
  Partials      751      751           

Flag	Coverage Δ
shard-1	44.04% <ø> (ø)
shard-2	35.69% <ø> (ø)
shard-3	32.18% <ø> (ø)
shard-4	32.68% <ø> (ø)
shard-5	31.79% <ø> (ø)
shard-6	44.12% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.