fix: use npm trusted publishing (OIDC provenance) instead of NPM_TOKEN

Author: quantizor

.github/workflows/release.yml

@@ -37,4 +37,4 @@ jobs:
           commit: 'chore: version packages'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true