fix(publish): Pack tarball with --ignore-scripts (#416)

Removing .npmrc's ignore-scripts=true in #413 had an unintended
consequence: `npm pack` now runs the project's own `prepare`
script (husky), which dumps lifecycle output to stdout. With
TARBALL=$(npm pack), that output gets captured alongside the
tarball filename, producing a multi-line value that breaks
$GITHUB_OUTPUT's key=value\n format and fails the build job.

pnpm's `allowBuilds` whitelist only gates *dependency* install
scripts; it doesn't suppress the project's own scripts during
`npm pack`. Adding --ignore-scripts to the pack invocation
restores clean stdout. Husky's `prepare` doesn't need to run
during CI pack anyway — git hooks aren't relevant in the
ephemeral runner.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: csandman

.github/workflows/publish.yml

@@ -82,7 +82,7 @@ jobs:
       - name: Pack tarball
         id: pack
         run: |
-          TARBALL=$(npm pack)
+          TARBALL=$(npm pack --ignore-scripts)
           echo "tarball=$TARBALL" >> "$GITHUB_OUTPUT"
 
       - name: Upload tarball artifact