[rasulkireev]

Summary

• Remove workflow_dispatch from the npm publish workflow so publishing happens only from published GitHub Releases.
• Document the release flow in the README: merging feature PRs is not enough; maintainers need to bump the package version and create a GitHub Release to put changes in users' hands.
• Fix the release tag ancestry guard so it fetches origin/master normally instead of relying on a depth-1 fetch that can falsely reject older release tags.

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/publish-npm.yml"); puts "workflow yaml parses"'
• npm run build
• npm test