chore: remove unused npm-publish composite action

The composite action has been replaced with a reusable workflow pattern.
npm publish now runs directly in publish.yml with full OIDC support.

Author: sreya