devops: restore npm publishing from GitHub Actions

[Yury Semikhatsky (yury-s)]

Summary

• Regular publishing (@next, Beta Kuang (@beta), latest) goes back to the GitHub Actions workflow with OIDC trusted publishing and provenance.
• The ESRP pipeline stays available for manual on-demand runs only (no automatic triggers).

[github-actions]

Test results for "tests 1"

3 flaky

⚠️ [firefox-library] › library/browsercontext-cookies-third-party.spec.ts:257 › third party 'Partitioned;' cookies `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-library] › library/browsercontext-cookies-third-party.spec.ts:470 › top level 'Partitioned;' cookie and same origin iframe `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-page] › page/page-goto.spec.ts:90 › should work with Cross-Origin-Opener-Policy `@firefox-ubuntu-22.04-node20`

51329 passed, 1247 skipped

---

Merge workflow run.

[github-actions]

Test results for "MCP"

5 failed
❌ [firefox] › mcp/annotate.spec.ts:251 › should route annotate to a running port dashboard @mcp-windows-latest-firefox
❌ [firefox] › mcp/cli-devtools.spec.ts:199 › recording-start-stop @mcp-windows-latest-firefox
❌ [firefox] › mcp/http.spec.ts:144 › http transport browser sigint @mcp-windows-latest-firefox
❌ [webkit] › mcp/cli-test.spec.ts:23 › debug test and snapshot @mcp-ubuntu-latest-webkit
❌ [webkit] › mcp/http.spec.ts:105 › http transport browser lifecycle (isolated) @mcp-ubuntu-latest-webkit

8296 passed, 1371 skipped

---

Merge workflow run.

[github-actions]

🟢 CI is clear — all failures are pre-existing MCP flakes

Hi, I'm the Playwright bot and I took a first look at the failing checks.

This PR only touches publishing config (.azure-pipelines/publish.yml and .github/workflows/publish_release.yml) — no product or test code. The two red jobs (ubuntu-latest - webkit, windows-latest - firefox) are all mcp/ tests, which don't exercise anything this diff changes. Each one has failed on other SHAs/PRs the diff can't be responsible for, so I'm calling the run green.

Details — 5 failures, all pre-existing flakes

Overall: the diff is devops-only (npm publishing moves back to GitHub Actions). None of the failing tests touch or import the publishing workflows, and every one flips verdict across unrelated runs in the aggregated CI results DB.

Pre-existing flake / infra

• [firefox] › mcp/annotate.spec.ts:251 › should route annotate to a running port dashboard — timeout waiting for the Sessions dashboard. Failed 1 / 712 runs; the other failure is on base-main push 8c47f596 and push b6462e9b, not this PR.
• [firefox] › mcp/cli-devtools.spec.ts:199 › recording-start-stop — failed 2 / 191 runs, on PRs feat(reporter): introduce TestStep.subtitle, unify step formatting #42422 and feat(locator): introduce locator.visible() #42479.
• [firefox] › mcp/http.spec.ts:144 › http transport browser sigint — close browser count off by one. Failed 4 / 712 runs, on PRs test(mcp): fix flaky 'click link' on firefox #42275, fix(recorder): support re-enabling recorder on the same context #42383 and pushes bfb42e59, c874c8a7.
• [webkit] › mcp/cli-test.spec.ts:23 › debug test and snapshot — empty snapshot string. Failed 2 / 725 runs; also on push bee00ad3.
• [webkit] › mcp/http.spec.ts:105 › http transport browser lifecycle (isolated) — 30s timeout. Failed 2 / 725 runs; also on PR Revert "chore: roll stable test runner to 1.62.0-beta-1784842988000" #42003.

Every test passes >98% of the time and has failed on SHAs unrelated to this PR, so these are flakes, not regressions.

_{Triaged by the Playwright bot - agent run}