chore: default to private npm publishing and unify publish scripts

[jacobsimionato]

Description of Changes

This PR updates the npm publishing configuration for all web renderer packages to default to private publishing and unifies the pre-publish preparation scripts.

• Default to Private Publishing: Removed the hardcoded --access public flag from the publish:package NPM scripts across all renderer packages (web_core, angular, lit, react, and markdown-it). Scoped @a2ui packages will now default to private publishing.
• New Public Publish Command: Added a publish:public script to all packages which calls npm run publish:package -- --access public for intentional public releases.
• Unified Publish Scripts:
  • Deleted the redundant renderers/markdown/markdown-it/prepare-publish.mjs script.
  • Updated the shared renderers/scripts/prepare-publish.mjs to resolve paths relative to import.meta.url (instead of process.cwd()), allowing it to be safely executed from nested package directories like markdown-it.
  • Added logic to the shared script to ensure @a2ui/web_core is correctly version-bumped in peerDependencies.
• Documentation: Updated renderers/docs/web_publishing.md to reflect the inclusion of the react package, explain the new default private publishing behavior, and document the publish:public command.

Rationale

By defaulting to private publishing, we reduce the risk of accidentally releasing unfinished packages publicly. Furthermore, unifying prepare-publish.mjs ensures all renderer packages share the exact same publishing metadata preparation logic (such as stripping devDependencies and updating file: dependencies), making the repository easier to maintain.

Testing/Running Instructions

1. Check out this branch.
2. Navigate to any renderer package (e.g., cd renderers/markdown/markdown-it).
3. Run npm run build followed by node ../../scripts/prepare-publish.mjs.
4. Inspect the generated dist/package.json file. Ensure that:
   • The @a2ui/web_core version in peerDependencies/dependencies has been correctly updated to ^0.9.0.
   • devDependencies have been removed.
   • Internal paths in main, types, and exports no longer contain the ./dist/ prefix.
5. Attempting to run npm run publish:package will prepare the dist folder and run npm publish dist/ (which defaults to private). Running npm run publish:public will append --access public.

[gemini-code-assist]

Code Review

This pull request standardizes the npm publishing workflow across all @a2ui web packages by separating the default private publishing command from a new public publishing script. Key changes include updating the documentation to include the React package, bumping the web_core version to 0.9.0, and enhancing the shared prepare-publish.mjs script to support peer dependency updates and more reliable path resolution. Additionally, the package-specific preparation script for markdown-it was removed in favor of the shared utility. I have no feedback to provide.

[ava-cassiopeia]

Why are we defaulting to private publishing, I don't think we can even do that, right? The NPM org is a public-only org, we'd have to upgrade it to support private publishing.