feat: publish as @img2threejs/plugin-cs2 on npm

[kokorolx]

Summary

• Adds package.json for npm distribution as @img2threejs/plugin-cs2, mirroring the version/description from plugin.json (Apache-2.0, from LICENSE).
• files whitelist: CHANGELOG.md, CONTRIBUTING.md, SECURITY.md, SKILL.md, docs, domain.json, gates.json, grimoire, plugin.json, skills, spec_search_profile.json, steps.json, tools — every git-tracked top-level entry except tests/, .opencode/ and other dotfiles, README.md/LICENSE/package.json (auto-included by npm). CHANGELOG.md is listed explicitly since npm does not auto-include it.
• .github/workflows/ci.yml and publish.yml are thin callers into the org's shared img2threejs/ci-workflows reusable workflows (python-ci.yml for PR/push testing, npm-publish.yml for tag-triggered publish), pinned to a specific ci-workflows commit SHA per that repo's pinning policy.
• Documents the release flow in CONTRIBUTING.md under "Publishing to npm".

Dependency

• publish.yml is pinned to 27da7a68505591492cb4ef7358968890c6e39844 on img2threejs/ci-workflows branch feat/reusable-npm-publish (PR feat: add reusable npm publish workflow ci-workflows#2), not yet merged to ci-workflows main. Re-pin to the merged main SHA once that PR lands.
• ci.yml uses python-ci.yml already on ci-workflows main (SHA 4b7a0612d2c52815792124a18ae3f9032a4f0a88).

Test command

python3 -m unittest discover -s tests

No harness clone here — this repo's own CONTRIBUTING.md/README.md already state the suite "runs standalone" and doesn't need the base skill's test tree, and a search of tests/ finds no reference to IMG2_HARNESS_DIR/IMG2_HOME/a sibling harness checkout at all (unlike the other four plugins). Verified by cloning this branch into a fresh directory and running the exact command above with no sibling checkout present: 70 tests, OK.

Notes

• Publishing uses a NPM_TOKEN secret (a granular npm automation token with publish rights on @img2threejs) rather than OIDC trusted publishing — that's the shared workflow's house style. A maintainer needs that secret set (org- or repo-level) before the first tag-triggered publish. Prerelease tags (v1.2.3-beta.1) publish under the matching dist-tag; re-pushing an already-published version is a no-op.

Test plan

• npm pack --dry-run confirms the tarball's 61 files match every git-tracked path except tests/ and dotfiles.
• Test command proven green (70 passed) with no sibling harness checkout, matching this repo's documented standalone suite.
• CI test job passes on this PR once ci-workflows access is available to Actions.