Co-authored-by: Ona <no-reply@ona.com>
Requires NPM_TOKEN secret. Builds, tests, then publishes with provenance. Co-authored-by: Ona <no-reply@ona.com>