fix: use npm trusted publishing (OIDC) instead of NPM_TOKEN

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: yamitzky

.github/workflows/release.yml

@@ -37,6 +37,5 @@ jobs:
         with:
           node-version: "22"
           registry-url: "https://registry.npmjs.org"
+      - run: npm install -g npm@latest
       - run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package.json

@@ -22,6 +22,10 @@
   "engines": {
     "bun": ">=1.0"
   },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "dependencies": {
     "@optique/core": "latest",
     "@optique/run": "latest",