feat(ci): switch to OIDC trusted publishing with provenance

Replace classic NPM_TOKEN auth with GitHub Actions OIDC identity.
Add id-token: write permission and restore provenance in publishConfig.

Author: nigel-dev

.github/workflows/publish.yml

@@ -16,6 +16,7 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
+  id-token: write
 
 concurrency:
   group: semantic-release-${{ github.ref }}
@@ -65,4 +66,3 @@ jobs:
           fi
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package.json

@@ -12,7 +12,8 @@
     }
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "files": ["dist"],
   "scripts": {