feat: publish as @img2threejs/plugin-character on npm

[kokorolx]

Summary

• Adds package.json for npm distribution as @img2threejs/plugin-character, mirroring the version/description from plugin.json (Apache-2.0, from LICENSE).
• files whitelist: CHANGELOG.md, SKILL.md, domain.json, gates.json, plugin.json, reference, tools — every git-tracked top-level entry except tests/ (none in this repo), .opencode/ and other dotfiles, README.md/LICENSE/package.json (auto-included by npm). CHANGELOG.md is listed explicitly since npm does not auto-include it.
• .github/workflows/ci.yml and publish.yml are thin callers into the org's shared img2threejs/ci-workflows reusable workflows (python-ci.yml for PR/push testing, npm-publish.yml for tag-triggered publish), pinned to a specific ci-workflows commit SHA per that repo's pinning policy.
• Documents the release flow in README.md under "Publishing to npm".

Dependency

• publish.yml is pinned to 27da7a68505591492cb4ef7358968890c6e39844 on img2threejs/ci-workflows branch feat/reusable-npm-publish (PR feat: add reusable npm publish workflow ci-workflows#2), not yet merged to ci-workflows main. Re-pin to the merged main SHA once that PR lands.
• ci.yml uses python-ci.yml already on ci-workflows main (SHA 4b7a0612d2c52815792124a18ae3f9032a4f0a88).

Test command

git clone --depth 1 https://github.com/img2threejs/img2 ../img2-harness
mkdir -p ../img2home
ln -s "$(cd ../img2-harness && pwd)" ../img2home/harness
IMG2_HOME="$(cd ../img2home && pwd)" python3 -m unittest discover -s tests

This repo's suite is not fully subprocess-isolated: tests/test_rig_mesh_parity.py, test_rig_glb_reference.py, test_anim_action_design.py, and test_anim_clip_features.py import their tool modules directly, and those tools run the standard img2 bootstrap stanza at import time (IMG2_HOME env var, expecting $IMG2_HOME/harness to contain img2_core). test_gate_rigging.py separately subprocesses its tool and looks for a sibling img2/img2-harness directory. The command above satisfies both: a real sibling clone for the subprocess path, plus an IMG2_HOME pointing at a symlink farm for the in-process imports.

Verified by cloning this branch into a fresh directory and running the exact command above: 235 tests, OK (5 skipped). The 5 skips are the optional base-skill (img2threejs) comparison test in test_rig_spec_agreement.py, which is designed to skip when only the plugin is checked out — unrelated to this CI setup.

Notes

• Publishing uses a NPM_TOKEN secret (a granular npm automation token with publish rights on @img2threejs) rather than OIDC trusted publishing — that's the shared workflow's house style. A maintainer needs that secret set (org- or repo-level) before the first tag-triggered publish. Prerelease tags (v1.2.3-beta.1) publish under the matching dist-tag; re-pushing an already-published version is a no-op.

Test plan

• npm pack --dry-run confirms the tarball includes plugin.json, SKILL.md, domain.json, gates.json, CHANGELOG.md, reference/*, tools/*.py and excludes .opencode/.
• Test command proven green (235 passed, 5 skipped) in a fresh sibling-clone layout (see above).
• CI test job passes on this PR once ci-workflows access is available to Actions.