fix: separate npm tag from release branch

[fqjony]

Problem

release_branch currently has two unrelated jobs: it identifies the Git branch allowed to release and becomes npm's --tag value. A caller that releases from main therefore publishes a package as main, leaving the normal latest install on an older version.

Change

• add an independent npm_tag input, defaulting to latest
• retain release_branch solely as the Git release gate
• document intentional non-default npm tags and the migration path

Validation

• YAML parse
• bash tests/docker-ops-build-args.sh

[Copilot]

Pull request overview

This PR updates the npm-release-ops reusable workflow contract so npm dist-tag selection (npm_tag) is independent from the Git release gate (release_branch), aligning npm publishing behavior with the documented intent (default publish to latest unless explicitly overridden).

Changes:

• Added a new npm_tag workflow input (default latest) and plumbed it through job outputs/env.
• Updated the publish step to use npm_tag for npm publish --tag, while keeping release_branch solely for branch gating.
• Updated docs and examples to include npm_tag and clarify the migration for callers.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
examples/npm-release-ops.yml	Demonstrates providing npm_tag explicitly in the caller example.
docs/workflows/npm-release-ops.md	Documents the new npm_tag input, clarifies branch vs dist-tag behavior, and adds migration guidance.
.github/workflows/npm-release-ops.yml	Introduces npm_tag input and uses it for npm publishing while preserving release_branch gating logic.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

examples/npm-release-ops.yml:20

• provenance and enable_gh_release are defined as boolean inputs in the reusable workflow, but this example passes them as quoted strings ("true"). For workflow_call typed boolean inputs, this can fail validation in the caller workflow. Use YAML booleans (true/false) instead.

      npm_tag: "latest"
      provenance: "true"
      dist_dir: "dist"
      enable_gh_release: "true"