ci: publish RC via OIDC, retire token-based rc.yml

[technophile-04]

Summary

release.yml already publishes main via OIDC trusted publishing (provenance, published by GitHub Actions since 0.1.6), but rc.yml never got that migration. It still runs the old NPM_TOKEN path — no id-token permission, no registry-url, node 20 — so the RC channel either fails or publishes unsigned token releases while main goes out tokenless. This folds the release-candidate trigger into release.yml and deletes rc.yml.

Concretely

• release.yml now triggers on release-candidate as well as main. npm trusted publishing is keyed to repo + workflow filename, so reusing release.yml means RC publishes through the publisher npm already trusts — no new npm-side config, no token.
• Deleted rc.yml. Its token auth predates the OIDC work (last touched in merge release-candidate  #56, before allow permission for oidc #84/gh-actions: add link to repo-url + configure permissions #87 moved main to OIDC). Keeping a second workflow is exactly how it drifted out of sync, so we retire it rather than re-patch it.
• Pre mode stays per-branch: main cuts normal releases, release-candidate (after changeset pre enter rc) cuts -rc.N versions on the rc dist-tag, leaving latest untouched.

Why

We want a tight loop for shipping pre-release versions to test against scaffold-eth-2 before they reach latest — first use being the squared/edgy redesign (#110), which we want to validate end to end in a real SE-2 app. With this, SE-2 installs @rc and sees changes without affecting anyone on stable.

Cutting an RC (after this merges)

git switch -c release-candidate origin/main
pnpm changeset pre enter rc        # keeps the RC off `latest`
git merge remove-rounded           # bring in the redesign (#110)
pnpm changeset                     # add it here: components + debug-contracts, minor
git push -u origin release-candidate

The changesets action opens a Version Packages PR against release-candidate; merging it publishes the -rc.N via OIDC to the rc tag. Then in SE-2: set both packages to "rc" and pnpm install.

Sanity check the first run with npm dist-tag ls @scaffold-ui/components — the new version should land on rc, with latest unchanged. If pre enter rc was skipped it'd cut a normal release instead, so that's the one thing to confirm.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
scaffold-ui-docs	Ready	Preview, Comment	Jun 3, 2026 5:12am
scaffold-ui-example	Ready	Preview, Comment	Jun 3, 2026 5:12am

[rin-st]

Lgtm, thank you!