chore(release): declare public access for the scoped package

Scoped packages default to access=restricted, so 'npm publish' would fail with
402 Payment Required despite the controlstack org being owned. Declaring it in
publishConfig means the first publish cannot forget the --access public flag.

Verified: npm publish --dry-run resolves name @controlstack/oac at 1.1.0.

package.json

@@ -35,6 +35,9 @@
   "engines": {
     "node": ">=20.0.0"
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "test": "pnpm run test:all",
     "test:all": "pnpm --dir evals/framework run eval:sdk",