feat: bootstrap workflow for a new package's first npm publish

[nit23uec]

Summary

• Adds .github/workflows/bootstrap-npm-publish.yaml: a manual (workflow_dispatch) workflow for the one-time first publish of a brand-new workspace package (still "private": true). OIDC Trusted Publishing can't authenticate a package's first-ever publish since no trust binding can exist for a package not yet on the registry.
  • Validates the target package is private and not already published.
  • Flips "private": true off and pushes that commit to main as adobe-bot.
  • Publishes once via npm publish --access public, authenticated with the classic ADOBE_BOT_NPM_TOKEN secret.
  • Opens a draft PR adding the package to the PACKAGES array in scripts/setup-npm-trusted-publishers.sh (source-only — running the script to actually register OIDC trust is still a manual follow-up).
  • Shares the npm-publish environment (main-only branch policy) and npm-publish-main concurrency group with the routine release job so it can't run off main or race a real release.
• Updates docs/RELEASE-RUNBOOK.md:
  • New "Bootstrapping a new package's first publish" section documenting the flow.
  • Reworks "ADOBE_BOT_NPM_TOKEN retirement" → "ADOBE_BOT_NPM_TOKEN" — the token is reinstated (scoped to the npm-publish environment) to back this workflow; main.yaml's routine release job stays 100% OIDC.
  • Cross-reference to the new workflow file.

Setup required before this workflow can run

• Recreate the ADOBE_BOT_NPM_TOKEN secret (an npm automation token for the adobe-bot account), ideally scoped to the npm-publish GitHub Environment rather than repo-wide.

Test plan

• bash -n on every extracted run: step passes (verified locally)
• YAML parses cleanly (verified locally with yaml.safe_load)
• Dry-run the workflow against a real still-private package (e.g. spacecat-shared-akamai-client) once ADOBE_BOT_NPM_TOKEN is in place, confirm: private flip commits to main, package publishes, draft trust-registration PR opens with correct PACKAGES insertion

🤖 Generated with Claude Code