ci: stage release tarballs from verified builds

[binjospookie]

I cleaned up the CI/CD pipeline following Andrey Sitnik’s guide.

Changes:

• Added zizmor to check GitHub Actions workflows.
• Moved dependency setup into a shared action and added --ignore-scripts to installation.
• Moved npm dist-tag calculation from the publish job to the build job.
• Separated building from publishing. In the release workflow, only the publish job has id-token: write, and it installs no dependencies.
• The build job creates three tarballs with pnpm pack and uploads them as an artifact. The publish job downloads that artifact and stages the tarballs.
• Switched from direct publishing to npm stage publish, which requires manual approval.
• The publish job uses npm bundled with Node.js, so it does not need to install pnpm.
• Enabled organization-wide 2FA for everyone with access to grlt-hub.
• Enabled immutable GitHub Releases for future releases.

The main thing to verify is the first end-to-end release run, especially the clean install with --ignore-scripts.

[binjospookie]

I propose updating the release workflow in a separate PR to follow Vitest’s approach:

• We manually run the release workflow, selecting the branch and version.
• A bot runs bumpp and opens a release PR.
• Merging the release PR triggers checks, packaging, and npm stage publish.
• Once staging succeeds, the bot tags the release commit.

The benefits are:

• The tag is created only after npm stage publish succeeds.
• Releases are initiated explicitly through a workflow and reviewed in a dedicated PR.

Flow
Example