Prepare 0.7.0-rc.0 release

[zuchka]

Summary

• bump package and lockfile metadata to 0.7.0-rc.0
• add an npm Trusted Publishing workflow gated by the GitHub npm environment
• verify that release tags match the package version, prerelease state, and a commit on main
• publish prereleases to next and stable releases to latest
• make nested package and type checks meaningful when invoked by npm publish --dry-run
• canonicalize the repository URL used for npm provenance

No package is published by this PR. The publishing workflow runs only after a GitHub release is published and then waits for approval through the npm environment.

Verification

• npm ci and npm audit: zero vulnerabilities
• npm publish --dry-run --tag next --access public: passed without warnings
• existing behavior and packed CommonJS/ESM tests: passed
• TypeScript consumer compilation and Are the Types Wrong: passed
• differential comparison against published 0.6.4: passed
• esbuild and Rollup consumers: passed
• Deno source and packed-package checks: passed
• release workflow validation and actionlint: passed

The dry-run artifact contains the expected seven files and reports:

• package: remove-markdown@0.7.0-rc.0
• packed size: 4,519 bytes
• integrity: sha512-azpkjtazriq0EgapkKDGPf+Ap0Goet+ZDcY+iLXwXk73f/sNT2gYUwxpwNm3ZYUwh2KR6IpPtlN4r/BWm9WJwA==

Required after merge, before creating the release

• Create a GitHub environment named npm with manual approval
• Configure the npm trusted publisher for zuchka/remove-markdown, workflow publish.yml, environment npm, with npm publish permission
• Create a GitHub prerelease/tag named 0.7.0-rc.0
• Approve the npm environment deployment and verify next points to 0.7.0-rc.0 while latest remains 0.6.4