packaging: registry dep, publish scope, CI workflow

- @tenere/pltc-core switches from a machine-local file: dependency to the
  published ^0.6.3 from the Tenere npm registry (the file: path does not
  exist in a fresh checkout; lockfile regenerated to the tarball).
- .npmrc routes @tenere and @arbiter scopes alongside @rigor so registry
  installs and the eventual publish resolve against the hub.
- package.json gains a files whitelist (src/ only) so tests, benchmarks,
  and scratch directories never ship in the tarball.
- .gitea/workflows/ci.yaml: node 22, full suite + rigor campaigns on push/
  PR, npm publish on v* tags to the Arbiter org registry.

package.json

@@ -10,6 +10,9 @@
     ".": "./src/index.js",
     "./package.json": "./package.json"
   },
+  "files": [
+    "src/"
+  ],
   "scripts": {
     "test": "node --test --test-force-exit \"tests/**/*.test.js\" \"tests/integration/*.js\"",
     "test:all": "npm test",
@@ -55,7 +58,7 @@
     "dsl"
   ],
   "dependencies": {
-    "@tenere/pltc-core": "file:../../../../data_structures/pltc-core",
+    "@tenere/pltc-core": "^0.6.3",
     "heapify": "^1.0.2",
     "uuidv7": "^1.0.2"
   },