Fix RC publish by merging into single workflow (#56)

The separate publish-rc.yml workflow failed because npm OIDC provenance
auth includes the workflow file path in token claims. Only publish.yml was
authorized. Consolidate both workflows into publish.yml with RC detection.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: AmethystLiang

.github/workflows/publish-rc.yml

@@ -4,7 +4,6 @@ on:
   push:
     tags:
       - "v*"
-      - "!v*-rc.*"
 
 jobs:
   release:
@@ -17,6 +16,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - name: Detect release type
+        id: meta
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          if [[ "$TAG" == *"-rc."* ]]; then
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+            echo "npm_tag=rc" >> "$GITHUB_OUTPUT"
+          else
+            echo "prerelease=false" >> "$GITHUB_OUTPUT"
+            echo "npm_tag=latest" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
@@ -47,9 +58,10 @@ jobs:
             release/agent-slack-*
             release/checksums-sha256.txt
           generate_release_notes: true
+          prerelease: ${{ steps.meta.outputs.prerelease == 'true' }}
 
       - name: Build for npm
         run: bun run build:npm
 
       - name: Publish to npm
-        run: npm publish --provenance --access public
+        run: npm publish --provenance --access public --tag ${{ steps.meta.outputs.npm_tag }}