ci(release): publish to npm via OIDC trusted publishing

Node 24 bundles npm 11.17.0, which clears the npm >= 11.5.1 floor that
previously made trusted publishing unavailable, so the long-lived NPM_TOKEN
is no longer needed.

pnpm publish shells out to the ambient npm, and npm's OIDC exchange
overwrites the registry _authToken it resolves from .npmrc, so no other
change to the publish step is required.

Requires a trusted publisher (this repo, release.yml) to be registered on
npmjs.com for every published package before the next tag, since the token
exchange is per package name.

Author: not-matthias

.github/workflows/release.yml

@@ -78,7 +78,6 @@ jobs:
           fi
         env:
           NPM_CONFIG_PROVENANCE: true
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - if: github.event_name == 'push'
         name: Create a draft release