feat(cloudsmith): add CI and switch to Cloudsmith for installs

[raiseandfall]

Summary

Adds a GitHub Actions CI workflow (this repo had none) and migrates installs from the private npm registry (registry.npmjs.org) to Cloudsmith. Modeled directly on learningmachine/fw-state's setup — same situation (scoped @learningmachine package, no publish automation, manual npm publish).

Changes

• New .github/workflows/ci.yml: checkout → setup node → Cloudsmith OIDC auth (cloudsmith-io/cloudsmith-cli-action) → npm ci → npm run build --if-present (swapped for npm run test since this repo has no test script, unlike fw-state).
• .npmrc: global registry= now points at Cloudsmith (npm.artifacts.hyland.dev/cic-unified-shared-libs), authenticated via CLOUDSMITH_API_KEY.
• package.json: added overrides pinning minimatch and @types/minimatch, and pinned the direct tslib dependency, to the exact versions the previous lockfile had. A full re-resolution against Cloudsmith otherwise lets these drift to newer majors that break this repo's build (modern minimatch .d.ts syntax breaks the ancient TypeScript 2.9.2 compiler; newer tslib's exports map breaks rollup-plugin-typescript2's way of loading it).
• package-lock.json regenerated against Cloudsmith — same resolved versions as before, just a different registry.
• New Semantic Release step in .github/workflows/ci.yml, mirroring web-shared-models's setup (cycjimmy/semantic-release-action@v6, same branch pattern with master swapped in for main). Bumped workflow permissions.contents to write and added a job-level GITHUB_TOKEN env, both required for the release step.
• New release.config.js with the same plugin pipeline as web-shared-models (commit-analyzer, release-notes-generator, changelog, npm, github, git).

Requirements

• A CLOUDSMITH_NAMESPACE repo/org variable must be set.
• A matching Cloudsmith OIDC Service must be registered (see learningmachine/tf-config-cloudsmith's locals-learningmachine.tf — PR pending there too, slug: learningmachine-caching).

Notes

• The semantic-release config mirrors web-shared-models as-is, including its existing gap: @semantic-release/changelog and @semantic-release/git are not in cycjimmy/semantic-release-action's default plugin set and would normally need extra_plugins declared on the step. Left unchanged intentionally to match the reference setup.

Verification

Clean install resolves every package through Cloudsmith (confirmed via package-lock.json), and npm run build produces the same dist/ output as before the change.

[raiseandfall]

Added a follow-up commit switching this repo's .github/dependabot.yml from the old registry.npmjs.org + static token setup to Cloudsmith via GitHub's native Dependabot OIDC support (no secrets stored), using the org-wide learningmachine-dependabot Cloudsmith service account already trusted in tf-config-cloudsmith.