Add generic publish pipeline that supports both internal and external
publishing via environment variables, without leaking any internal URLs
or tool references into the public repository.
- Update package.json version to 1.0.0 for first public release
- Fix urlPattern to include version in binary filename, matching Makefile output
- Fix Makefile sha256sum target to output sha256sum.txt without version suffix
