ci: release @e2b/pi over npm trusted publishing

[OndrejDrapalik]

Summary

• Changesets for versioning (@changesets/cli 2.31.1, same as claude-toolsets and E2B); package.json gets publishConfig.access: public, a version script (changeset version + lockfile refresh) and a release script (changeset publish, deliberately not named publish)
• release.yml: dispatch-only, refuses any ref but main, green no-op without a pending changeset, runs npm run check, then publishes in the deployment environment over OIDC (no npm token) and pushes the version bump with the e2b-version-bumper app
• A patch changeset, so the first dispatch ships 0.1.1 as the first attested release

Already in place outside the repo: @e2b/pi@0.1.0 published by hand, npm trusted publisher (release.yml + deployment), deployment environment limited to main, version bumper installed and on the main bypass list.

Test plan

• npm run check and actionlint clean
• npm run version dry run in a scratch copy: 0.1.1 in package.json and lockfile, CHANGELOG.md written
• After merge: gh workflow run release.yml --ref main, then npm view @e2b/pi shows 0.1.1 with attestations