ci(evaluation): publish typescript package with npm oidc

[cre8ivejp]

Fix #2755

Summary

• add a manual workflow for publishing @bucketeer/evaluation using npm trusted publishing
• remove the legacy NPM_TOKEN configuration
• bump the package to 0.0.9 and restrict published files
• document the new release process

Test plan

• Install dependencies without an npm token
• Generate protobuf code and build the package
• Run npm publish --dry-run
• Run the GitHub workflow with dry_run enabled after merge**

[Copilot]

Pull request overview

Adds a manual GitHub Actions workflow to publish the @bucketeer/evaluation TypeScript package to npm using trusted publishing (OIDC), removing the legacy NPM_TOKEN-based flow and documenting the new release process.

Changes:

• Add workflow_dispatch publish workflow that uses npm OIDC trusted publishing and supports a dry_run option.
• Remove NPM_TOKEN usage/configuration from the TypeScript evaluation package and CI.
• Bump @bucketeer/evaluation to 0.0.9 and restrict published contents via files in package.json.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
evaluation/typescript/README.md	Updates setup/release documentation to describe the new manual publish workflow (OIDC) and removes token-based instructions.
evaluation/typescript/package.json	Bumps version to 0.0.9, sets publishConfig.access, and restricts published files.
evaluation/typescript/.npmrc	Removes legacy token-based npm authentication configuration.
.github/workflows/publish-evaluation-ts.yaml	Adds a manual workflow to build and publish the package to npm via OIDC trusted publishing (with optional dry run).
.github/workflows/pr-evaluation-ts.yaml	Removes NPM_TOKEN from the PR workflow environment configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

.github/workflows/publish-evaluation-ts.yaml:9

• dry_run defaults to false, so clicking “Run workflow” will publish immediately unless the user changes the input. To reduce the chance of accidental releases, consider defaulting dry_run to true and requiring an explicit opt-in to publish.

      dry_run:
        description: "Dry run (do not actually publish)"
        required: false
        default: false
        type: boolean