fix npm publish path spec: bare dist-npm/<name> parses as GitHub shorthand

[iamalwaysuncomfortable]

Motivation

The v0.2.1 release — the first real execution of npm-publish.yml — failed in the Publish step with:

npm error command git --no-replace-objects ls-remote ssh://git@github.com/dist-npm/darwin-arm64.git

The publish loop strips the trailing slash from each package directory (publish "${pkg%/}"), and npm's spec parser treats a bare a/b argument as the GitHub shorthand github:a/b, not a local path — so npm tried to fetch a nonexistent GitHub repo over SSH instead of publishing the directory. The bug was latent since the workflow was introduced in #24. Prefixing ./ makes the argument unambiguously a filesystem path.

Nothing was published before the failure (it died on the first package), so re-dispatching the workflow for v0.2.1 after this merges will perform the complete bootstrap publish.

Verified by local reproduction: npm publish --dry-run dist-npm/foo fails with the same git error; npm publish --dry-run ./dist-npm/foo packs the directory correctly. Also verified the ./ prefix keeps the package.json name lookup inside publish() working, and the workflow passes YAML validation.

Test Plan

• Local reproduction and fix verification with npm publish --dry-run (see above).
• Real verification: re-dispatch Publish to npm with tag v0.2.1 after merge; all six packages should publish.

Related PRs

• consolidate npm publishing for trusted publishing (OIDC) #26 (publish flow consolidation; surfaced this by making the failure loud)
• add standalone npm publish workflow #24 (introduced the latent bug)