feat: add tag-triggered release workflow with OIDC publishing

Create GitHub Release with extension zip and publish MCP server to npm
when a v* tag is pushed. Uses npm OIDC trusted publisher for
authentication — no secrets to manage.

Closes #209

Author: purupurupu

.github/workflows/release.yml

@@ -0,0 +1,45 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: jdx/mise-action@v2
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm fmt:check
+      - run: pnpm lint
+      - run: pnpm build
+      - run: pnpm test
+
+      - name: Install Playwright for e2e
+        run: pnpm exec playwright install chromium
+
+      - run: pnpm test:e2e
+
+      - name: Zip extension
+        run: cd dist && zip -r ../css-noop-checker-${{ github.ref_name }}.zip .
+
+      - name: Create GitHub Release
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            "css-noop-checker-${{ github.ref_name }}.zip#Chrome Extension" \
+            --title "${{ github.ref_name }}" \
+            --generate-notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish MCP server to npm
+        working-directory: mcp-server
+        run: npm publish --provenance --access public