fix(ci): harden npm trusted publishing (OIDC) in release workflows

[PAMulligan]

Summary

Hardens npm Trusted Publishing (OIDC) in both release workflows so automated and manual publishes reliably authenticate tokenlessly. Fixes the manual workflow's ENEEDAUTH and the automated workflow's npm warn Unknown user config "always-auth".

Changes

Commit 1 — fix(ci): OIDC hardening (release-please.yml + publish-npm.yml)

• Replace npm install -g npm@latest with a pinned npm install -g npm@^11, then assert npm ≥ 11.5.1 (sort -V guard) and prepend the freshly-installed npm's global bin to PATH via $GITHUB_PATH, so the publish steps cannot silently fall back to Node's bundled npm 10.x. The job now fails loudly instead of publishing under an OIDC-incapable npm.
• Add a "Sanitize npm config for OIDC" step that strips the deprecated always-auth key and the placeholder _authToken from the .npmrc that actions/setup-node generates ($NPM_CONFIG_USERCONFIG), keeping the registry= line OIDC needs.
• Document that each package's npm trusted publisher is bound to the repo + the exact workflow filename, so renaming either file breaks publishing until the npm trusted-publisher config is updated to match.
• Stays tokenless — no NPM_TOKEN. Permissions unchanged (id-token: write; plus contents: write for release-please).

Commit 2 — ci(deps): action bumps to Node 24 majors (separate, revertible)

• actions/checkout v4→v7, actions/setup-node v4→v6, pnpm/action-setup v4→v6, googleapis/release-please-action v4→v5.

Why this fixes the failures

• ENEEDAUTH (manual): publish was running under Node 22's bundled npm 10.x, which predates OIDC, so npm never attempted trusted publishing and fell back to the empty placeholder token. Pinning + asserting + forcing the upgraded npm onto PATH guarantees npm publish runs under ≥ 11.5.1.
• always-auth / OIDC (automated): actions/setup-node@v4 writes always-auth=false into its generated .npmrc; npm ≥ 11 rejects it as unknown config. The sanitize step removes it (and the placeholder token); setup-node@v6 also stops writing it at the source.

Test plan

• Both workflows parse as YAML (js-yaml).
• No @v4 action refs remain; bumped versions confirmed.
• Needs a real run to confirm end-to-end: next release publish (release-please.yml on merge to main) authenticates via OIDC with no always-auth warning; manual publish-npm.yml dispatch (after temporarily repointing the package's trusted publisher to publish-npm.yml) publishes without ENEEDAUTH.

Notes

• No committed .npmrc exists anywhere in the repo (root, widget/, create-claudius/, worker/, docs/) — the always-auth warning came solely from setup-node's runtime-generated file, which the sanitize step cleans in-job.

🤖 Generated with Claude Code