ci: drop Node 20 + add environment: production to publish job (fix OIDC) (#159)

* ci: drop Node 20 from CI matrix

Node 20 is EOL and the pinned pnpm no longer supports it (Node 20 leg
fails install with ERR_PNPM_UNSUPPORTED_ENGINE). Keep 22 + 24.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci(npm-publish): add environment: production to publish job for OIDC

The npm trusted publisher for this package is scoped to the `production`
environment, but the publish-github-packages job did not declare it, so the
OIDC token lacked the environment claim and npm rejected the trusted publish
with ENEEDAUTH (run 28196102507). Every other repo already sets this.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jaysin586

.github/workflows/coveralls.yml

@@ -15,7 +15,7 @@ jobs:
         runs-on: blacksmith-2vcpu-ubuntu-2404 # trunk-ignore(actionlint/runner-label)
         strategy:
             matrix:
-                node-version: [20, 22, 24]
+                node-version: [22, 24]
         steps:
             - name: Checkout
               uses: actions/checkout@v6 # zizmor: ignore[unpinned-uses]

.github/workflows/npm-publish.yml

@@ -200,7 +200,7 @@ jobs:
         runs-on: blacksmith-2vcpu-ubuntu-2404 # trunk-ignore(actionlint/runner-label)
         strategy:
             matrix:
-                node-version: [20, 22, 24]
+                node-version: [22, 24]
         permissions:
             contents: read
             packages: write
@@ -307,6 +307,7 @@ jobs:
         needs: [check-if-merged, build, playwright-tests, coverage-report]
         if: needs.check-if-merged.outputs.should_run == 'true'
         runs-on: ubuntu-latest
+        environment: production
         permissions:
             contents: write
             packages: write