[ci] Auto-publish CIRCT WASM artifacts to release on main push

Add a 'Publish CIRCT wasm to release' step that runs `npm run publish:circt`
(sync-circt-wasm.sh --publish) after a successful build on main. This keeps
the circt-wasm GitHub Release in sync with whatever CIRCT ref is locked in
toolchain.lock.sh, so the deploy workflow always serves fresh artifacts.

Requires contents:write permission (added) for gh release upload.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: thomasahle

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: write  # needed for gh release upload (publish:circt step)
+
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -94,6 +97,12 @@ jobs:
             --retries 3 \
             --log-dir "$LOG_DIR"
 
+      - name: Publish CIRCT wasm to release
+        if: github.ref == 'refs/heads/main'
+        run: npm run publish:circt
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Upload UVM smoke logs
         if: always()
         uses: actions/upload-artifact@v4