chore: add npm release workflow for the tracing plugin

[milanagm]

Refs LFE-15729. Step 2 of moving this plugin to npm distribution.

Important

Draft, stacked on #62. This branch contains #62's commit, so the diff below also shows plugins/tracing/package.json until that PR merges.

Why

#62 makes the plugin a publishable npm package. This adds the release automation, modelled on the in-house precedent in langfuse/pi-observability-plugin.

What this PR does

• .github/workflows/release.yml (new): tag-triggered on v*, validates versions, installs, lints, tests, stages the package on npm with provenance, then creates a draft GitHub release. Prerelease tags (v0.2.0-rc.1) go out under the next dist-tag.
• package.json: adds npm: 11.15.0 as a devDependency. npm stage publish does not exist in npm 10.9.8, which is what Node 22 bundles, so pnpm exec npm needs a pinned newer npm. Same approach pi uses.

Verified locally

Each workflow step run by hand (codex-cli 0.149.0, npm 11.15.0, node 24.16.0):

Check	Result
actionlint on release.yml	no findings
version validation (the exact node -p commands)	package.json 0.1.0 == plugin.json 0.1.0
pnpm install --frozen-lockfile	pass
pnpm run lint	pass
pnpm test	40/40
staging step as npm publish --dry-run from plugins/tracing	prepack builds, @langfuse/codex-observability-plugin@0.1.0, 4 files
pnpm exec npm --version in that step	11.15.0, stage subcommand available
prerelease branch logic	v0.1.0/v0.2.0 → latest, v0.2.0-rc.1/v1.0.0-beta.2 → next

Not verified, and one thing a maintainer has to do

The workflow has never actually run. It only triggers on a v* tag, and a test run would stage a real package on npm. The YAML and every step were checked individually; the end-to-end run is open until the first real tag.

Before the first release, a maintainer of the @langfuse npm scope has to configure npm trusted publishing (OIDC) for @langfuse/codex-observability-plugin, with this repository and release.yml as the trusted publisher. Without that, the first run fails at authentication. I do not have access to do this.

Release flow this enables

1. Bump the version in both plugins/tracing/package.json and plugins/tracing/.codex-plugin/plugin.json, rebuild the bundle (pnpm run build), commit.
2. Tag v<version> and push the tag.
3. The workflow validates, tests, stages on npm, and opens a draft GitHub release.
4. npm stage list @langfuse/codex-observability-plugin, then npm stage approve <stage-id> (requires npm 2FA). Or npm stage reject.
5. Publish the draft GitHub release.

Related

• chore: add npm package manifest for the tracing plugin #62 — the package manifest this depends on
• fix: make tracing hook command Windows-compatible #61 — switches the hook command to ${PLUGIN_ROOT}. Needed before the first version bump: the current hard-coded tracing/0.1.0 cache path breaks on any other version. Verified locally. Not touched here to avoid duplicating that PR.