Split npm publish out of sync.yml into its own manually-triggered workflow

[michael-anastasakis]

Summary

• sync.yml no longer publishes to npm. It still syncs, rebuilds, tests, commits, tags, and creates the GitHub release exactly as before.
• New publish.yml: manually triggered (workflow_dispatch, requires a ref input — e.g. v1.0.1), runs the test suite against the checked-out tag, then publishes via npm OIDC trusted publishing (no NPM_TOKEN, no long-lived secrets).

Why

• main now has branch protection requiring PR review; sync.yml's direct git push --follow-tags only works for identities on the bypass list, so it made sense to stop bundling an npm-auth-dependent step into that same job.
• npm can't publish yet anyway — no auth is configured, and Trusted Publishing can only be set up once a first version exists on the registry.
• Publishing becomes a deliberate button-press rather than an automatic side effect of the daily sync, per @alexey-milovidov's request.

Next steps (after merge)

1. Manually publish the first version (npm login && npm publish --access public) from a local checkout — one-time, since Trusted Publisher can't be configured before the package exists on npm.
2. Configure npm Trusted Publisher for @clickhouse/lexer: GitHub Actions, org ClickHouse, repo clickhouse-lexer, workflow publish.yml.
3. Set the package's "Publishing access" to "Require two-factor authentication or automation tokens."
4. From then on, publishing a synced release is Actions → "Publish to npm" → Run workflow → ref = the tag to publish.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com