refactor: npm trusted publishing (OIDC) — tokenless CI publishing

- Node 22 + latest npm for trusted publishing support
- id-token: write permission for OIDC
- Remove NODE_AUTH_TOKEN (not needed with trusted publishing)
- First publish of each package still needs manual token+OTP

Author: BartWaardenburg

.github/workflows/release.yml

@@ -78,7 +78,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -174,9 +174,12 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           registry-url: https://registry.npmjs.org
 
+      - name: Ensure latest npm (for trusted publishing)
+        run: npm install -g npm@latest
+
       - name: Install @napi-rs/cli
         run: npm install -g @napi-rs/cli
 
@@ -214,35 +217,25 @@ jobs:
             npm publish "$dir" --access public --provenance || echo "Skipping $(basename "$dir")"
           done
         working-directory: packages/codec
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish @srcmap/codec
         run: npm publish --access public --provenance --ignore-scripts
         working-directory: packages/codec
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish @srcmap/sourcemap platform packages
         run: |
           for dir in npm/*/; do
             npm publish "$dir" --access public --provenance || echo "Skipping $(basename "$dir")"
           done
         working-directory: packages/sourcemap
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish @srcmap/sourcemap
         run: npm publish --access public --provenance --ignore-scripts
         working-directory: packages/sourcemap
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish @srcmap/sourcemap-wasm
         run: npm publish --access public --provenance --ignore-scripts
         working-directory: packages/sourcemap-wasm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   create-release:
     name: Create GitHub Release