chore: automate npm publishing with trusted provenance

[MeliValesca]

Publish npm releases from v* tags through GitHub Actions and npm trusted publishing, following the Hinges release flow. Package version remains 5.10.0; the separate version bump is in #780.

The workflow validates release metadata and the tarball, runs the existing JavaScript and Android/iOS checks on the same commit, then publishes after release-environment approval. There are no manual or dry-run triggers. Normal PR CI tests the release safeguards and inspects the package.

Retained safeguards beyond the Hinges flow:

• Save the inspected tarball for seven days so publish retries use the same bytes without repeating native CI.
• Verify registry integrity and provenance; skip an identical published version and fail on a conflict without moving newer dist-tags backward.
• Allow ten minutes for npm processing after acceptance, based on the delay encountered during the previous library release.

Correct repository URL casing for provenance and document tagging and recovery in RELEASE.md. Local npm publication remains disabled in the existing release-it configuration.

Validation: nine release-safety tests, metadata validation, actionlint on all four affected workflows, Prettier, and git diff --check pass after simplification. Earlier validation also passed formatting, ESLint, TypeScript, 26 Jest tests, 11 snapshots, library build, and inspection of the 183-file tarball. Hosted CI runs on the updated head.

External setup is complete: npm trusted publisher appandflow/react-native-safe-area-context / release.yml / release with direct npm publish permission; GitHub release environment permits v* tags and requires approval. Merging this PR does not publish. The next intentional release will verify OIDC publication end to end.

[janicduplessis]

I think we can remove this, the agent doesn't need to know and it will already be setup