feat: publish as @img2threejs/plugin-hello-cube on npm

[kokorolx]

Summary

• Adds package.json for npm distribution as @img2threejs/plugin-hello-cube, mirroring the version/description from plugin.json (Apache-2.0, from LICENSE).
• files whitelist: SKILL.md, gates.json, plugin.json, steps.json, tools — every git-tracked top-level entry except tests/, dotfiles, README.md/LICENSE/package.json (auto-included by npm).
• .github/workflows/ci.yml and publish.yml are thin callers into the org's shared img2threejs/ci-workflows reusable workflows (python-ci.yml for PR/push testing, npm-publish.yml for tag-triggered publish), pinned to a specific ci-workflows commit SHA per that repo's pinning policy. This repo owns only its triggers and its test-command.
• Documents the release flow in README.md under "Publishing to npm".

Dependency

• publish.yml is pinned to 27da7a68505591492cb4ef7358968890c6e39844 on the img2threejs/ci-workflows branch feat/reusable-npm-publish (PR feat: add reusable npm publish workflow ci-workflows#2), which is not yet merged to ci-workflows main. Re-pin to the merged main SHA once that PR lands.
• ci.yml uses python-ci.yml already on ci-workflows main (SHA 4b7a0612d2c52815792124a18ae3f9032a4f0a88).

Test command

git clone --depth 1 https://github.com/img2threejs/img2 ../img2-harness
python3 -m unittest discover -s tests

Verified by cloning this branch plus a shallow img2threejs/img2 checkout into the sibling layout the tests expect (tests/test_hello_cube.py looks for ../img2-harness or IMG2_HARNESS_DIR) and running the exact command above: 6 tests, all passing.

Notes

• Publishing uses a NPM_TOKEN secret (a granular npm automation token with publish rights on @img2threejs) rather than OIDC trusted publishing — that's the shared workflow's house style. A maintainer needs that secret set (org- or repo-level) before the first tag-triggered publish. Prerelease tags (v1.2.3-beta.1) publish under the matching dist-tag; re-pushing an already-published version is a no-op.

Test plan

• npm pack --dry-run confirms the tarball includes plugin.json, SKILL.md, gates.json, steps.json, tools/*.py and excludes tests/.
• Test command proven green in a fresh sibling-clone layout (see above).
• CI test job passes on this PR once ci-workflows access is available to Actions.