ci(release): use trusted publishing

Author: flovogt

.github/workflows/release-please.yml

@@ -26,7 +26,7 @@ jobs:
     if: ${{needs.pull-request.outputs.releases_created && toJson(fromJson(needs.pull-request.outputs.paths_released)) != '[]'}}
     runs-on: ubuntu-24.04
     permissions:
-      id-token: write # Required for trusted publishing via OIDC (https://docs.npmjs.com/trusted-publishers)
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -55,12 +55,8 @@ jobs:
         run: |
           rm package.json
           mv package.json.bak package.json
-      - name: Publish to NPM
-        env:
-          NPM_TOKEN: ${{secrets.NPM_TOKEN}}
-        run: |
-          echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> ./.npmrc
-          npm publish --provenance --access public
+      - name: Publish to npm
+        run: npm publish --access public --provenance
 
   publish-mcp-registry:
     needs: [pull-request, publish-package]