ci: migrate npm publishing to trusted publishing (OIDC)

[Copilot]

Replaces the long-lived NPM_TOKEN secret with npm's OIDC-based trusted publishing, which was already configured on npmjs.com but not wired up in the workflow.

Changes

• Removed the .npmrc token injection step (_authToken=${{ secrets.NPM_TOKEN }}) — no longer needed
• Added permissions: id-token: write to let the job request a GitHub OIDC token, and contents: write for git tagging / GitHub release creation
• Added NPM_CONFIG_PROVENANCE: true env var so release-it's internal npm publish passes --provenance, triggering the automatic OIDC token exchange with the npm registry

[RichardLindhout]

@copilot still not working? Run yarn release
yarn run v1.22.22
$ release-it --ci --github.autoGenerate
ERROR Not authenticated with npm. Please npm login and try again.
Documentation: https://git.io/release-it-npm

error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
Error: Process completed with exit code 1.