fix: npm provenance (#37)

Enable OIDC for trusted publishing and npm provenance.

Author: DoneDeal0

.github/workflows/cd.yml

@@ -33,11 +33,11 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Build the project
+      - name: Build
         run: npm run build
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
-        run: npx semantic-release
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npx semantic-release

.github/workflows/ci.yml

@@ -21,6 +21,7 @@ jobs:
         with:
           node-version: "24"
           cache: "npm"
+          registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
         run: npm ci