security(release): drop .npmrc NPM_TOKEN write, rely on npm trusted publishing

The previous publish flow wrote a static `_authToken` from the
`NPM_TOKEN` secret into `~/.npmrc` before invoking `pnpm publish`. On
pnpm < 11.0.7 a configured `_authToken` takes precedence over OIDC
trusted publishing, so even though all `@rspack/*` packages have a
trusted publisher binding configured on npmjs.com, releases were still
authenticating with a long-lived token. The static-credential surface
is exactly what enables the TanStack 2026-05-11-style attack: anything
that runs in the `npm`/`npm-canary` environment can exfiltrate
`process.env.NPM_TOKEN` and publish arbitrary versions.

Deleting the `.npmrc` write makes OIDC the only auth path. `pnpm
publish` now mints a per-run token via the workflow's `id-token: write`
permission and authenticates against the trusted publisher binding
configured on npmjs.com.

Provenance (`--provenance` flag) is unaffected; it was already using
OIDC for signing and is independent of publish auth.

After merge, the `NPM_TOKEN` secret in the `npm` and `npm-canary`
GitHub environments has no remaining consumer and should be removed
from environment secrets to fully retire the credential.

Author: stormslowly

scripts/release/publish.mjs

@@ -10,7 +10,6 @@ const __dirname = path.dirname(__filename);
 
 export async function publish_handler(mode, options) {
   console.log('options:', options);
-  const npmrcPath = `${process.env.HOME}/.npmrc`;
   const root = process.cwd();
   const version = await getLastVersion(root);
   const name = await getPkgName(root);
@@ -26,17 +25,6 @@ export async function publish_handler(mode, options) {
     throw Error('Latest tag cannot be prerelease version');
   }
 
-  if (fs.existsSync(npmrcPath)) {
-    console.info('Found existing .npmrc file');
-  } else {
-    console.info('No .npmrc file found, creating one');
-
-    fs.writeFileSync(
-      npmrcPath,
-      `//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}`,
-    );
-  }
-
   await publish(options);
 
   core.setOutput('version', version);