Add a Release dsh plugin workflow (dsh-plugin-v* tags or workflow_dispatch) that reads NPM_TOKEN from the GitHub Environment of the same name. The Cordis plugin id stays dsh-plugin-browserskill; only the npm package name changes.
