ci: publish @redsentech/lean-harness to GitHub Packages

- Rename npm package scope @redsen -> @redsentech (GitHub Packages
  requires the scope to match the owning org/user login).
- Add publishConfig.registry pointing at npm.pkg.github.com.
- Add .github/workflows/publish.yml: on push of a vX.Y.Z tag (or manual
  dispatch), runs validate + test, checks the tag matches
  package.json's version, then npm publish using the auto-issued
  GITHUB_TOKEN (packages: write permission, no secret to manage).
- Update README/QUICKSTART lh-CLI install instructions for the private,
  org-scoped registry (.npmrc scope + auth token setup).
- Verified locally with npm publish --dry-run: 68 files, correct
  registry target, correct tarball contents.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/publish.yml

@@ -0,0 +1,51 @@
+name: Publish
+
+# Builds and publishes @redsentech/lean-harness to GitHub Packages (npm.pkg.github.com),
+# a private-by-default scoped registry tied to this repository — not the public npm registry.
+#
+# Triggers:
+#   - push of a version tag (v0.1.0, v1.2.3, ...) — the normal release path
+#   - manual dispatch, for re-publishing without cutting a new tag
+#
+# Auth: GITHUB_TOKEN (auto-issued per run, no secret to manage) is sufficient for GitHub
+# Packages when the job declares `permissions: packages: write`.
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@redsentech'
+
+      - run: npm install
+      - run: npm run validate
+      - run: npm test
+
+      - name: Verify tag matches package.json version
+        if: github.event_name == 'push'
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PKG_VERSION="$(node -p "require('./package.json').version")"
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "::error::tag v$TAG_VERSION does not match package.json version $PKG_VERSION"
+            exit 1
+          fi
+
+      - run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}