[sasan1200]

What changed

• Add publish-npm.yml: on each published GitHub release it checks that the tag matches package.json, skips a version already on npm, runs npm test and npm run verify:package, then runs npm publish --access public --provenance through npm trusted publishing (OIDC, no stored token).
• README and the installation page install with npm install -g @cavi-ai/ableton-mcp and register the server as ableton-mcp serve; source checkouts remain documented.
• CHANGELOG entry under Unreleased.

Why

• @cavi-ai/ableton-mcp is not on the npm registry, so installing requires a source checkout.
• Publishing requires a trusted publisher on npmjs.com for cavi-ai/ableton-mcp and publish-npm.yml.

Verification

• npm test (Node 22.13.0 and 24.22.1)
• npm run verify:package, if packaging, the CLI, or the bridge install changed (Node 22.13.0 and 24.22.1)
• npm run docs:tools, if a tool contract changed
• Checked against a running Live, if Live-side behavior changed (Live version: )
• npm run eval:core (Node 22.13.0 and 24.22.1)
• npm publish --dry-run --access public: @cavi-ai/ableton-mcp@0.4.0, 347 files, 891.2 kB
• Release docs build and verify for v0.4.0

Contract impact

• No tool, resource, or prompt contract change
• Tool contract changed and reference/tools.md regenerated