setup automatic CI provenance publishing to npm

[lazarusA]

There is already a workflow present, but it would be nice to make sure it works plus do a check on tags before publishing, similar to this