ci: add canary release on push to main

[bntvllnt]

Summary

• Adds canary.yml workflow: auto-publishes pre-release to npm on every push to main
• Version format: {package.version}-canary.{sha7} (e.g., 0.2.0-canary.abc1234)
• Published under canary npm tag — does not affect latest
• OIDC provenance for supply chain security
• Concurrency group cancels stale canary runs

How it works

push to main
  → typecheck + test + build
  → stamp version: 0.2.0-canary.{sha7}
  → npm publish --tag canary --provenance

Consumers install canary: pnpm add @vllnt/convex-mcp@canary
Stable releases remain via publish.yml (triggered by GitHub Release).

Test plan

• Workflow syntax valid (YAML linted)
• Verify canary publishes after merge (check npm @vllnt/convex-mcp@canary)