CI for tagging and pushing releases

[mattrobenolt]

Right now, our release process is manual and a bit flawed.

Our internal steps have been:

npm version minor
git push --tags
npm publish

But this isn't great.

• it relies on being able to bypass branch protections and push directly to main. The "bump" commit goes directly to main. 68ed111 This requires permission or rules to bypass branch protection.
• npm publish requires permission to push to npm, and this should just be a bot.