ci(release): add tag publish workflow

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Author: leeguooooo

.github/workflows/publish-npm.yml

@@ -0,0 +1,55 @@
+name: Publish NPM Package
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24.x"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: "10"
+
+      - name: Ensure npm supports trusted publishing
+        run: npm install -g npm@latest
+
+      - name: Check tag matches package version
+        id: version
+        run: |
+          PKG_VERSION=$(node -p "require('./packages/yapi-mcp/package.json').version")
+          if [ "v$PKG_VERSION" != "${GITHUB_REF_NAME}" ]; then
+            echo "match=false" >> $GITHUB_OUTPUT
+            echo "Skip publish: tag ${GITHUB_REF_NAME} does not match v${PKG_VERSION}."
+            exit 0
+          fi
+          echo "match=true" >> $GITHUB_OUTPUT
+
+      - name: Install dependencies
+        if: steps.version.outputs.match == 'true'
+        run: pnpm -C packages/yapi-mcp install --frozen-lockfile
+
+      - name: Build package
+        if: steps.version.outputs.match == 'true'
+        run: pnpm -C packages/yapi-mcp build
+
+      - name: Publish to npm
+        if: steps.version.outputs.match == 'true'
+        working-directory: packages/yapi-mcp
+        run: npm publish