[devin-ai-integration]

Summary

Bumps mta-js to 2.5.0 to ship the new agency clients from #13 (mta.mbta, mta.bart, mta.kingCountyMetro, mta.capMetro, mta.pace, mta.triRail, mta.brightline, mta.bayWheels, mta.divvy, mta.bluebikes). 2.4.0 is already on npm.

publish.yml now publishes from a push to main instead of from a pushed tag:

on push to main (or workflow_dispatch):
  if npm already has name@version → skip
  else → bun test, typecheck, pack dry run, npm publish,
         then gh release create v<version> --target $GITHUB_SHA --generate-notes

• A release only happens when package.json has a version that isn't on npm yet. Every other push to main is a no-op.
• The tag and release are created after npm publish succeeds, so a failed publish leaves no tag behind.
• The file name stays publish.yml, so the npm trusted-publisher config (OIDC, id-token: write) still matches. contents: write was added so the workflow can create the tag and release.
• The tags: v* trigger was removed. A tag created by GITHUB_TOKEN doesn't trigger workflows anyway, and keeping the trigger would let a manually pushed tag publish twice.

Merging this PR publishes 2.5.0 and creates the v2.5.0 release.

Link to Devin session: https://app.devin.ai/sessions/8d319beac0174974a184312ce7c14932
Open in Devin Desktop: https://app.devin.ai/desktop/session/8d319beac0174974a184312ce7c14932?variant=devin
Requested by: @gtokman

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring