ci: add release workflow via workflow_dispatch

[rochdev]

Summary

• Adds .github/workflows/release.yml: a workflow_dispatch workflow with a patch/minor/major input that bumps the version, publishes to npm with provenance (no token required), pushes the version commit and tag via dd-octo-sts, and creates a GitHub release with auto-generated notes
• Adds .github/chainguard/self.release.sts.yaml: octo-sts policy scoped to workflow_dispatch events from release.yml on main, granting contents: write

Setup required

• Configure dc-polyfill on npmjs.com to trust GitHub Actions from DataDog/dc-polyfill (Provenance/trusted publishing)
• Create an npm environment in the GitHub repo settings (used as a gate on the release job)

Test plan

• Verify npm trusted publishing is configured for the package
• Trigger the workflow with patch on a test run
• Confirm version commit and tag are pushed to main
• Confirm package is published to npm
• Confirm GitHub release is created with generated notes

🤖 Generated with Claude Code