[ottonomy]

Stacked on #78 — review and merge that first.

Closes #55.

What changed

• Prereleases can publish. npm 11 refuses a bare npm publish of a prerelease version. A GitHub release marked as a pre-release now publishes with --tag beta; any other release publishes with --tag latest. This uses beta rather than the next named in Publish prereleases under the next tag, and check before publishing #55, by maintainer decision; it matches the existing beta dist-tag.
• Checks before publishing. The workflow stops if the release tag (without its leading v) differs from the package.json version, or if the pre-release setting disagrees with whether the version has a prerelease suffix. It then runs lint, the build, and the Node and browser tests, as ci.yml does.
• npm is pinned to 11.21.1 instead of npm@latest.
• RELEASING.md documents the npm trusted-publisher setup and how to fill in the GitHub release form, with a README link.

Before the first release

An npm admin of @digitalcredentials/verifier-core must register this workflow as a trusted publisher on npmjs.com (steps in RELEASING.md). No GitHub secrets are needed.

Validation

• actionlint on publish.yml: clean.
• The check step's script, run on its own: the matching tag/flag/version combinations pass; a tag mismatch and both pre-release mismatches fail with clear errors.
• pnpm run build and pnpm run test (lint + 1003 Node tests): pass.
• The workflow itself runs only on a real release, so it is untested until the first one.

🤖 Generated with Claude Code