ci: use trusted publishing (OIDC), remove token secret

No NPM_TOKEN needed — npm trusted publishing handles auth via
GitHub Actions OIDC identity token.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: isaacrowntree

.github/workflows/publish.yml

@@ -24,6 +24,4 @@ jobs:
 
       - run: npm test
 
-      - run: npm publish --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - run: npm publish --provenance --access public