fix publish workflow: add build step, use OIDC trusted publishing, bump 0.0.196

publish was missing a build step so the npm tarball had no dist/.
switch from NPM_TOKEN to OIDC trusted publishing — explicitly unset
NODE_AUTH_TOKEN so setup-node's .npmrc doesn't override the OIDC flow.
bump version since v0.0.195 tag exists from the failed publish attempt.

Made-with: Cursor

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.0.195",
+  "version": "0.0.196",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",