ci: publish from the npm environment

[clappingmonkey]

What & why

The publish job now runs in the npm GitHub environment (audit item M4, option C). The environment is already created with these settings:

• deployments only from branch main (type branch, so a tag named main doesn't count)
• no required reviewers
• admins can't bypass it

The OIDC token for trusted publishing can therefore only be issued to a job running from main. A copy of the publish job on another branch, or a manual run from another ref, can't publish.

Rollout order. With an environment set, the OIDC sub claim becomes repo:clappingmonkey/opencode-circadian:environment:npm, so npm's trusted publisher config has to match.

1. On npmjs.com, open the package's Trusted Publisher settings and set Environment name to npm.
2. Merge this PR right after.

No release PR is pending, so nothing publishes between the two steps. If a publish ever fails on a mismatch, fix the npm setting and use "Re-run failed jobs" on the publish job.

Closes: N/A (audit item M4)

Behavior impact

• Theme-switching logic (periodFor, boundaries, gentle override)
• Plugin options (dayTheme, nightTheme, dayStartHour, nightStartHour,
  checkIntervalMs, toast) — README options table updated
• Lifecycle / timer / toast behavior
• Packaging (package.json exports, files, published contents)
• No user-facing behavior change

Testing

• npm run typecheck passes (run by CI; this PR only changes a workflow)
• npm test passes (run by CI; this PR only changes a workflow)
• Manually verified in opencode (if behavior changed): not applicable, no behavior change

Also verified:

• actionlint passes.
• Environment settings checked through the GitHub API.

Checklist

• PR title follows Conventional Commits
  (enforced by the PR Title check; drives the release-please version bump)
• Defaults still work with zero config
• Docs updated if behavior/config changed (no behavior/config change)
• No secrets or credentials introduced