ci: add registry-url to publish workflow for OIDC auth (#753)

## Summary
The previous `Publish NPM` workflow dispatch failed with `ENEEDAUTH`
because `setup-node` was missing `registry-url`, so `npm publish` didn't
use the OIDC token. Adds `registry-url: 'https://registry.npmjs.org'`
and bumps node 20 → 24 to match the release-please publish job.

## Why this matters
OIDC trusted publishing is now configured on npmjs.com for `smithery`.
With this fix, the workflow can actually use it.

## Test plan
- [ ] Merge
- [ ] Dispatch `Publish NPM` from Actions tab → should publish
`smithery@1.0.0` with provenance

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: calclavia

.github/workflows/publish.yml

@@ -19,8 +19,9 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: 'pnpm'
+          registry-url: 'https://registry.npmjs.org'
 
       - run: pnpm install --frozen-lockfile