fix: invalid release tagging in npm.yml

[jescalada]

Fixes bug preventing NPM releases from being created due to tags being in valid semver format.

[github-actions]

Thanks for the contribution! I notice a couple of things that need attention:

Description clarity: Could you provide a bit more detail about what specifically was wrong with the tags and how your fix addresses it? This will help reviewers understand the change better.

Linked issue: I don't see a linked issue in your description. According to our contributing guidelines, PRs should either link to an existing issue using keywords like "Fixes #N" or "Closes #N", or you should create a new issue first. Could you either:

• Link to an existing issue if this addresses one, or
• Create a new issue describing this bug and then reference it here?

This helps us track and discuss changes properly. Thanks!

[github-actions]

🔒 Automated Security Review

Security Review: No Issues Found

✅ No security vulnerabilities detected in this pull request.

The change modifies the npm distribution tag format from v${MAJOR_MINOR} to release-${MAJOR_MINOR} in the GitHub workflow. This is a simple string formatting change that doesn't introduce any security risks - the tag value is still derived from the same controlled MAJOR_MINOR variable and used in the same context for npm publishing.