Adopt npm trusted publishing in CI

[ryantm]

Why

• npm trusted publishing via GitHub OIDC removes the long-lived NPM_TOKEN requirement from the release workflow.
• npm's trusted publisher flow also requires a newer Node/npm runtime in the publish job.

What changed

• reduced the workflow's default permissions to read-only and scoped id-token: write to the publish job
• switched the publish job to actions/setup-node with Node 24 and the npm registry URL configured
• removed token-based npm auth from npm publish and updated the publishing docs to point at the CI.yml trusted publisher setup

Test plan

• git diff --check
• did not run repo tests; this only changes GitHub Actions workflow and publishing docs

Revertibility

• Safe to revert in git.
• If NPM_TOKEN is removed during rollout, reverting this workflow also requires restoring that secret or updating npm publishing settings to match.

~ written by Zerg 👾