chore(ci): switch publish workflow to npm OIDC trusted publishing (#61)

Drops the rotating NPM_TOKEN secret in favor of npm's OIDC trusted-publisher flow. The id-token: write permission was already declared on this job; this PR completes the swap by removing NODE_AUTH_TOKEN (no longer needed) and adding --provenance so each published version carries a signed attestation back to this workflow + tag. Trusted publisher must be configured at npmjs.com side first (Settings > Trusted Publishers > GitHub Actions, org=tangle-network, repo=agent-integrations, workflow=publish.yml) — completed before this PR landed. Fixes the E404-on-PUT failure mode that has blocked v0.29.0, v0.30.0, and v0.31.0 publishes.

Co-authored-by: Drew Stone <hello@tangle.tools>

Author: drewstone

.github/workflows/publish.yml

@@ -66,15 +66,18 @@ jobs:
       - run: pnpm run build
 
       # Idempotent: re-running a tag whose npm version is already published
-      # must not fail the workflow.
+      # must not fail the workflow. Auth is npm OIDC trusted publishing —
+      # configured at npmjs.com/package/@tangle-network/agent-integrations/access
+      # → Trusted Publishers → GitHub Actions (org=tangle-network,
+      # repo=agent-integrations, workflow=publish.yml). The id-token: write
+      # permission on this job exchanges a GitHub OIDC token for an
+      # npm-side publish credential at request time. No NPM_TOKEN secret.
       - name: Publish to npm (skip if already published)
         run: |
           NAME=$(node -p "require('./package.json').name")
           VERSION=$(node -p "require('./package.json').version")
           if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
             echo "$NAME@$VERSION already on registry; skipping publish"
           else
-            pnpm publish --no-git-checks --access public
+            pnpm publish --no-git-checks --access public --provenance
           fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}