fix: configure trusted publishing for changesets action

- Use changesets/action@main (includes #545 fix for trusted publishing)
- Set NPM_TOKEN to empty string so action doesn't write undefined to .npmrc
- Restore registry-url in setup-node (needed for .npmrc creation)
- Update npm to latest for trusted publishing support (requires >= 11.5.1)

Author: quantizor

.github/workflows/release.yml

@@ -24,17 +24,21 @@ jobs:
         with:
           node-version-file: '.nvmrc'
           cache: 'pnpm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Update npm for trusted publishing
+        run: npm install -g npm@latest
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: Create Release PR or Publish
-        uses: changesets/action@v1
+        uses: changesets/action@main
         with:
           publish: pnpm changeset publish
           title: 'chore: version packages'
           commit: 'chore: version packages'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ''
           NPM_CONFIG_PROVENANCE: true
-          NPM_CONFIG_REGISTRY: https://registry.npmjs.org