Decide whether and where to publish the widget to npm (heed-widget) #40

What is needed: a decision, and if yes an npm token. The widget now has an ES module package (widget/, built by npm run build:lib: heed-widget → registers <heed-feedback>, heed-widget/react → the React wrapper, a lazily imported screenshot chunk, type declarations). It is marked "private": true, so nothing has been published.

Without npm, sites use the served loader (one <script> tag, the main path) and React apps can render <heed-feedback> from it; only apps that want to bundle heed (and use <HeedFeedback> with typed props) need the package.

Recommendation: publish as heed-widget (free on npm as of 2026-10-13; @i2mint/heed-widget is also free if an i2mint npm org exists). Remove "private": true, add an NPM_TOKEN repository secret, and add a publish job to .github/workflows/widget.yml triggered on a widget-v* tag (so PyPI and npm releases stay independent). Publishing is hard to undo (npm unpublish limits), which is why this waits for you.

Not blocking: the widget issue (#6) is complete without it; the wrapper is built and tested from source in CI.