Restore npm publishing and decide v2/v3 consumer path

[flyingrobots]

Problem

v3.0.4 was merged and tagged from main, but the tag publish workflow failed at npm publish with npm E404 Not Found / permission denial for @git-stunts/trailer-codec@3.0.4. npm still reports latest as 2.1.1; GitHub Release v3.0.4 was not created because publish failed.

Evidence:

• PR fix(trailer-codec): publish type declarations #2 merged: fix(trailer-codec): publish type declarations #2
• Tag pushed: v3.0.4 -> 95ba0fba1d1ad06beb73b76470b12e71e495b2b6
• Failed workflow: https://github.com/git-stunts/trailer-codec/actions/runs/28131804750
• npm registry latest observed after failure: @git-stunts/trailer-codec@2.1.1

Why this matters

git-warp currently depends on @git-stunts/trailer-codec@^2.1.1, uses the synchronous v2 facade, and imports TrailerCodecFacade from the package declarations supplied by a local patch. The v3 mainline is async and is not a drop-in replacement for that consumer.

Required decision

Choose and execute one path:

1. Configure npm trusted publishing / token access for this repo, then publish the tagged v3 line and plan a git-warp async migration separately.
2. Cut a v2-compatible 2.1.2 backport that only adds TypeScript declarations for the existing sync API, then publish it so git-warp can remove its local patch without an async migration.

Do not remove git-warp's trailer-codec patch until one of those paths produces a consumable package version.

[flyingrobots]

Recovery update after PR #4:

• PR Fix trailer-codec release publishing #4 merged workflow-side hardening: npm 11.5.1, npm publish --access public --provenance, and a manual recover workflow.
• Recovery run for v3.0.4 still failed: https://github.com/git-stunts/trailer-codec/actions/runs/28132250097
• The publish step successfully created/signed provenance, then npm denied the package write with E404 Not Found - PUT https://registry.npmjs.org/@git-stunts%2ftrailer-codec.

Conclusion: this is now an npm registry authorization/trusted-publisher configuration blocker, not a package contents blocker. To recover v3.0.4, configure npm publishing for @git-stunts/trailer-codec from this GitHub repo/workflow (or provide an npm token with publish rights), then rerun the Recover Release workflow with tag=v3.0.4.