Publish blockpace-core to npm

[alihdrndm]

What

@alihdrndm/blockpace-core (the attrition math) is now a public npm package: https://www.npmjs.com/package/@alihdrndm/blockpace-core

• package.json: public, ships only dist (plus README and LICENSE), prepack rebuilds from a clean folder, keywords and repository links for npm search, and engines widened from >=24 <25 to >=20.
• Package README with a worked example and a table of what evaluate returns.
• .github/workflows/publish-core.yml: pushing a core-vX.Y.Z tag checks the tag matches the version, runs the core typecheck and tests, and publishes with npm trusted publishing (GitHub OIDC, no stored npm token) and provenance.
• Root README section, CHANGELOG and DECISIONS entries.

packages/db stays private.

Checks

• The packed tarball was installed into an empty folder and the README example was run on Node 20, 22 and 24: total 152880 ($1,528.80), nightly shortfalls [0, 2, 7, 0], risk level liable on all three.
• The example type-checks as a TypeScript consumer, and a deliberate typo in a risk level is rejected.
• Lint passes and all 91 core tests pass.
• 0.1.0 was published from a developer machine with 2FA; later versions go through the workflow.