ci: add PR test workflow; harden npm publish (idempotent, provenance, auth)

The repo had no CI on pull requests at all — only the convert workflow
(instruction-file paths) and the tag publish. Adds a Node 20/22/24 matrix
running build + tests + pack dry-run on every PR and main push.

Publish hardening: skip when the version already exists on the registry
(safe re-runs), enable --provenance (id-token permission was already
declared but unused), wire NODE_AUTH_TOKEN explicitly, add npm cache,
concurrency group, and a timeout.

Author: Disdjj

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Node ${{ matrix.node }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [20, 22, 24]
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      - run: npm ci
+      - run: npm run build
+      - run: npm test
+      - run: npm pack --dry-run

.github/workflows/publish-npm.yml

@@ -9,16 +9,22 @@ permissions:
   contents: read
   id-token: write
 
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
 
       - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
+          cache: npm
 
       - name: Verify tag matches package version
         run: |
@@ -32,4 +38,18 @@ jobs:
       - run: npm run build
       - run: npm test
       - run: npm pack --dry-run
-      - run: npm publish
+
+      - name: Publish (idempotent, with provenance)
+        run: |
+          set -euo pipefail
+          name=$(node -p "require('./package.json').name")
+          version=$(node -p "require('./package.json').version")
+          # Re-running the workflow for an already-published tag should be a
+          # no-op, not a 409 failure.
+          if npm view "${name}@${version}" version >/dev/null 2>&1; then
+            echo "${name}@${version} already published — skipping"
+          else
+            npm publish --provenance
+          fi
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}