chore: migrate to trunk-based development and tag-triggered npm releases

[ashleythedeveloper]

This PR migrates the repository from the two-branch (next + main) + release-please flow to trunk-based development on main with tag-triggered npm releases, mirroring the model used in tests-untp.

The rationale, scope, and migration sequence are documented in the new ADR at docs/adrs/001-trunk-based-development-and-tag-triggered-releases.md. In short: every release becomes a single tag push (v<X.Y.Z>); a pipeline-side script asserts the tag matches package.json before publishing; a disaster-recovery workflow handles unpublish (within 72h) or deprecate (after).

This PR is infrastructure only. package.json stays at 2.0.0. A follow-up PR will bring the digest-multibase work from next onto main, bump to 2.1.0, and tag for the first tag-triggered release.

What changes

• New: docs/adrs/001-...md, .github/workflows/release.yml, .github/workflows/unpublish-or-deprecate.yml, scripts/check-tag-version-match.mjs plus tests, RELEASE_NOTES.md.
• Removed: .github/workflows/release-and-publish.yml, .github/workflows/changelog.yml, .github/workflows/release-please-config.json, .github/workflows/.release-please-manifest.json.
• Updated: CHANGELOG.md (rewritten to Keep-a-Changelog, prior version history preserved), test-and-build.yml (PRs target main), eslint.config.js (recognises .mjs), README.md (new Releasing section).

Operator follow-up after merge

• Configure the npmjs.com Trusted Publisher for @pyx-industries/vc-render-template-utils to trust this repository's Release workflow.
• After PR 2 lands 2.1.0, push v2.1.0 tag to trigger the first release.
• Delete (or archive) origin/next once main is at parity. Update branch protection to protect main.

Test plan

• yarn lint, yarn format, yarn test, yarn build all pass locally (80 tests across 10 suites, 100% lines/statements coverage on the existing source, 7 new tests covering the version-match script).
• scripts/check-tag-version-match.mjs smoke-tested locally with match, version mismatch, wrong prefix, non-SemVer suffix, and GITHUB_REF_NAME-precedence cases. All seven automated tests in scripts/__tests__/check-tag-version-match.test.ts pass.
• On merge: confirm the new Release workflow is the only workflow that runs on a v* tag push (no leftover release-and-publish job).
• On first real release (PR 2 follow-up): verify OIDC Trusted Publishing authenticates and publishes with provenance.

[github-actions]

Code Coverage Report

Lines	Statements	Branches	Functions
	100% (145/145)	97.22% (35/36)	100% (26/26)

Tests	Skipped	Failures	Errors	Time
80	0 💤	0 ❌	0 🔥	2.229s ⏱️