ci: switch npm publish to GitHub OIDC trusted publishing

Remove NODE_AUTH_TOKEN/NPM_TOKEN — id-token: write already grants an OIDC
token that npm exchanges for a short-lived publish credential automatically.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Anonyfox

.github/workflows/publish.yml

@@ -49,7 +49,6 @@ jobs:
       - name: Publish to npm
         run: npm publish --provenance --access public
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2