chore: use npm trusted publishing with OIDC

Replace NPM_TOKEN with OIDC-based trusted publishing.
Requires Node.js 24 for npm >= 11.5.1 support.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: brendan-kellam

.github/workflows/release-mcp.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
 
       - name: Calculate new version
@@ -148,11 +148,9 @@ jobs:
         run: yarn workspace @sourcebot/mcp build
 
       - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           cd packages/mcp
-          npm publish --access public
+          npm publish --provenance --access public
 
       - name: Fast-forward main to temporary branch
         env: