Replace the git tag and xelp/dist shadow release with a workflow that publishes
to GitHub Packages as @plexinc/<name>, matching how the other Plex client repos
consume private packages. Authentication is the workflow GITHUB_TOKEN, so the
repository stores no publishing secret, and the package name is rewritten in CI
rather than on xelp/main, leaving upstream merges unaffected.

The lint and test suites previously ran as a side effect of npm version, which
triggers preversion. Setting the version with npm pkg set skips lifecycle
scripts, so they now run as their own steps.

Consumers keep the upstream package name by installing through an npm alias, so
imports, bin names and plugin references do not change.

Both workflows compute the same MAJOR.MINOR.<date><PATCH> version and so want
the same tag, and the shadow release force pushes it, so running the two against
one commit means one clobbers the other. Park the shadow release rather than
delete it, matching the .disabled convention already used in this family of
repos, so restoring it is a rename.

roku-client is the only consumer of this fork, and it keeps installing from the
existing git tag until it moves to the @plexinc package, so nothing depends on
this workflow staying runnable in the meantime.

The token was set on the two steps that obviously needed it, the published
version check and the publish. That is enough here, because this package has no
@plexinc dependencies of its own, but not in the forks that do:
brighterscript-formatter cannot run npm ci without it.

Give it to the install step as well, and keep it off the job so it stays out of
the environment of steps that never reach the network. This restores the file to
being identical to the copies in the other two forks.