ci: harden npm trusted publishing workflow

[kody-bot]

Why

@kentcdodds asked me to open this PR after reviewing the npm supply-chain risk described in the TanStack postmortem: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem

This repository already uses npm trusted publishing/OIDC for semantic-release, so this hardens the workflow by keeping package build/dependency execution out of the privileged publishing job where feasible.

What changed

• Build the package in an unprivileged job and upload the package output as a short-lived artifact.
• Keep the release job focused on downloading the prebuilt artifact and running semantic-release with OIDC permissions.
• Default workflow token permissions to read-only where the workflow did not already do so.

Notes

This follows the same pattern Kent has been applying to his own semantically-released trusted-publishing packages.

[Belco90]

No idea if @kody-bot will handle the requested changes? 😅

[Belco90]

@kody-bot avoid pinning semantic-release here, already fixed in the package.json

[MichaelDeBoey]

CC/ @kentcdodds

[kentcdodds]

Kody won't respond. Consider this a slightly more helpful than an issue notice 😅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.35%. Comparing base (80dbb49) to head (8cfbd05).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1315   +/-   ##
=======================================
  Coverage   97.35%   97.35%           
=======================================
  Files          49       49           
  Lines        6020     6020           
  Branches     1544     1544           
=======================================
  Hits         5861     5861           
  Misses        157      157           
  Partials        2        2           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.