ci: Guard publish-to-npm job behind merge check (#21691)

Author: seemewalkin

.github/workflows/release-publish.yml

@@ -26,6 +26,7 @@ jobs:
   publish-to-npm:
     name: Publish to NPM
     runs-on: ubuntu-latest
+    if: github.event.pull_request.merged == true
     timeout-minutes: 20
     permissions:
       id-token: write