feat(preview-release): add action for standalone library preview releases

[rqbazan]

What

Adds a new Node action preview-release — the standalone-library counterpart to monorepo-preview-release. It targets repos that publish a single npm package (not a pnpm workspace).

Per PR it:

1. Bumps the package in working_directory (default repo root) to <version>-git-<short-sha> via pnpm version prerelease.
2. Publishes it to npm under the pr-<n> dist-tag via pnpm publish.
3. Notifies vland-bot (GitHub OIDC, vland-bot audience) so it can comment the published version on the PR.

Differences vs. monorepo-preview-release

Since there's only one package, all the workspace machinery is removed:

• Dropped: workspace enumeration (pnpm list -r), PR-files change detection, internal dependency resolution, and the octokit / github_token input (no PR-files API call anymore).
• Added: a working_directory input (default ".") for libraries living in a subdirectory.

Kept identical (parity)

• Refusal to run on pull_request_target.
• The three auth modes: token-only / oidc-with-token-fallback / oidc-only, including the first-publish NPM_TOKEN fallback without provenance.
• Transient ~/.npmrc auth wrapping + core.setSecret masking.
• Same vland-bot endpoint and payload (/v1/github/preview-release).

Inputs

Input	Required	Default
npm_token	no	—
working_directory	no	.
vland_bot_url	no	https://bot.variable.land

Verification

• tsc --noEmit ✓
• biome check (via rr check) ✓ — 6 files, no fixes
• ncc build ✓ — dist/index.js committed and deterministic (rebuild is a no-op)
• Root README.md actions table updated

🤖 Generated with Claude Code