fix: exchange GitHub OIDC for npm publishing

[salim4n]

Summary

• exchange the GitHub Actions OIDC identity through npm's official package-token endpoint
• validate the repository, workflow, environment, runner, visibility, subject, and audience claims
• mask the ephemeral package-scoped token and remove its temporary npm configuration
• keep npm provenance generation enabled

Source

• private source commit: 763326ae6b5868711a24bb28f1afa21ae0b51b49
• public commit is SSH-signed and GitHub-verified

Validation

• public boundary validation
• 118 SDK tests
• TypeScript typecheck
• ESM and CommonJS builds and smoke imports
• dependency audit: no vulnerabilities
• npm package dry-run