fix: unset NPM_CONFIG_USERCONFIG to avoid empty token from setup-node

Author: orange-guo

.github/workflows/release.yml

@@ -31,9 +31,10 @@ jobs:
         # It will only publish if the version in package.json is new
         # Note: Trusted Publishing requires permissions: id-token: write
         run: |
-          # setup-node creates an .npmrc with an empty token which breaks Trusted Publishing
-          # We need to remove it but keep the registry configuration
-          rm -f .npmrc
+          # setup-node sets NPM_CONFIG_USERCONFIG to a file with an empty token
+          # We need to unset it to allow Trusted Publishing to work
+          unset NPM_CONFIG_USERCONFIG
+
           npm config set registry https://registry.npmjs.org/
 
           PACKAGE_NAME=$(node -p "require('./package.json').name")