packaging: registry dep, publish scope, CI workflow

- @tenere/pltc-core switches from a machine-local file: dependency to the
  published ^0.6.3 from the Tenere npm registry (the file: path does not
  exist in a fresh checkout; lockfile regenerated to the tarball).
- .npmrc routes @tenere and @arbiter scopes alongside @rigor so registry
  installs and the eventual publish resolve against the hub.
- package.json gains a files whitelist (src/ only) so tests, benchmarks,
  and scratch directories never ship in the tarball.
- .gitea/workflows/ci.yaml: node 22, full suite + rigor campaigns on push/
  PR, npm publish on v* tags to the Arbiter org registry.

.npmrc

@@ -1,2 +1,6 @@
 @rigor:registry=https://hub.kl1.tenere.ai/api/packages/Rigor/npm/
 //hub.kl1.tenere.ai/api/packages/Rigor/npm/:_authToken=${PACKAGE_TOKEN}
+@tenere:registry=https://hub.kl1.tenere.ai/api/packages/Tenere/npm/
+//hub.kl1.tenere.ai/api/packages/Tenere/npm/:_authToken=${PACKAGE_TOKEN}
+@arbiter:registry=https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/
+//hub.kl1.tenere.ai/api/packages/Arbiter/npm/:_authToken=${PACKAGE_TOKEN}