Publish to the GitLab package registry on version tags

The README's install line failed: the package was never published, and
nothing told npm where the @extant2000 scope lives. A tag like v1.2.3 now
publishes to this project's registry with CI_JOB_TOKEN, and the README
sets the scope's registry before installing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -1,6 +1,21 @@
-stages: [test]
+stages: [test, publish]
 
 test:
   stage: test
   image: node:22-alpine
   script: [npm ci, npm run build, npm test]
+
+# Publishes to this project's package registry on a version tag (v1.2.3).
+# CI_JOB_TOKEN has write access to the project's own registry, so no stored
+# secret is needed.
+publish:
+  stage: publish
+  image: node:22-alpine
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+  script:
+    - npm ci
+    - npm run build
+    - echo "@extant2000:registry=${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/npm/" > .npmrc
+    - echo "${CI_API_V4_URL#https:}/projects/${CI_PROJECT_ID}/packages/npm/:_authToken=${CI_JOB_TOKEN}" >> .npmrc
+    - npm publish

README.md

@@ -110,7 +110,11 @@ used a dynamic `.in()` filter.
 
 ## Install
 
+The package is published to the GitLab package registry, so point the
+`@extant2000` scope there first:
+
 ```
+npm config set @extant2000:registry https://gitlab.com/api/v4/packages/npm/
 npm install @extant2000/policy-enforced
 ```
 

package.json

@@ -12,6 +12,9 @@
     "README.md",
     "LICENSE"
   ],
+  "publishConfig": {
+    "@extant2000:registry": "https://gitlab.com/api/v4/projects/87000326/packages/npm/"
+  },
   "repository": {
     "type": "git",
     "url": "https://gitlab.com/extant2000/policy-enforced.git"