ci: add trusted ClawHub publishing

[rjcloudsigma]

Summary

Add a trusted GitHub OIDC ClawHub publication workflow for the legacy optimizer migration release.

The workflow:

• uses the clawhub-publish GitHub environment;
• requests only contents: read and id-token: write;
• runs install, tests, build, and ClawHub validation before publishing;
• derives the package owner from the trusted binding rather than overriding it;
• pins source ref and source commit to the exact authorized ${{ github.sha }};
• defaults to source version 0.12.0 and the latest tag.

Verification

• typecheck passed
• smoke passed
• 43 Node tests passed
• build passed
• ClawHub validation passed with zero warnings/issues
• git diff --check passed

One-time external prerequisite

After merge, a CloudSigma ClawHub organization owner must configure the trusted publisher for:

• package: @cloudsigma/openclaw-token-cache-optimizer
• repository: cloudsigma/openclaw-token-cache-optimizer
• workflow: publish-clawhub.yml
• environment: clawhub-publish

No long-lived ClawHub token or GitHub secret is required after that binding.