fix(release): configure npm trusted publishing

[drewstone]

Summary

• configure actions/setup-node with npm registry metadata for trusted publishing
• disable package-manager caching in the release job
• assert both settings in the release workflow contract test

Why

The first v0.12.2 publish run (33586800530) passed tag verification and all local gates, then npm publish failed with ENEEDAUTH. npm trusted publishing requires setup-node to configure the npm registry. The existing job granted id-token: write but omitted that configuration.

Verification

• pnpm exec vitest run tests/publish-workflow.test.ts --reporter=dot (2 passed)
• git diff --check
• pre-commit and pre-push hooks passed
• branch merges cleanly with origin/main

After merge, the existing immutable v0.12.2 tag can be rerun through workflow dispatch.

[tangletools]

✅ Auto-approved drewstone PR — e169d1a7

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

This approval is provisional. It rests on the audit running. If the audit cannot run — for example the CLI bridge rejects it — this approval is dismissed rather than left standing, so an unrun check never reads as a passing one.

_{tangletools · auto-approval · reason: drewstone_author · 2026-09-02T03:29:56Z}