[Chun-Lin]

Summary

• Add CI for pull requests and pushes to master (npm ci, tests, package inspection).
• Add tag-triggered release workflow using npm Trusted Publishing (OIDC) and npm stage publish instead of direct publishing.
• Document release versioning, npm trusted publisher configuration and manual 2FA approval.

Security

• No npm tokens or repository secrets required.
• Release staging requires a vX.Y.Z tag matching package.json.
• npm publish and npm dist-tag permissions can remain disabled on npm.
• npm maintainer must explicitly approve each staged release in npm with 2FA.

Checklist

• Verify GitHub Actions CI succeeds on this PR
• Confirm npm Trusted Publisher owner Chun-Lin, repo react-select-country-list, workflow publish.yml, environment blank
• Merge this PR only when approved
• Merge desired changes and bump version before creating a release tag

No npm release or stage was triggered by this PR.