ci: drop registry-url so npm uses OIDC trusted publishing

actions/setup-node with registry-url writes an .npmrc containing a placeholder
_authToken (XXXXX-XXXXX-XXXXX-XXXXX). npm sees a configured token and attempts
token auth with that garbage value instead of performing the OIDC
trusted-publishing exchange, producing a 404 on publish. Removing registry-url
leaves no auth token configured, so npm falls through to OIDC. The default
registry is already registry.npmjs.org.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Paul Mulligan

.github/workflows/publish-npm.yml

@@ -50,10 +50,13 @@ jobs:
         with:
           version: 9
 
+      # No registry-url: passing it makes setup-node write an .npmrc with a
+      # placeholder _authToken, and npm then does (failing) token auth instead
+      # of the OIDC trusted-publishing exchange. The default registry is already
+      # registry.npmjs.org, which is also where provenance must be published.
       - uses: actions/setup-node@v4
         with:
           node-version: 20
-          registry-url: https://registry.npmjs.org
           cache: pnpm
           cache-dependency-path: ${{ inputs.package }}/pnpm-lock.yaml