fix: support trusted publishing in semantic-release

[MehmetSecgin]

Summary

• pin the semantic-release plugins explicitly instead of relying on the older transitive npm publisher
• move the npm publisher to the trusted-publishing-capable plugin line and keep the GitHub plugin config current
• clarify in the release docs that this repo uses semantic-release with GitHub OIDC and should not set NPM_TOKEN

Notes

• follows up on the merged trusted-publishing workflow change by fixing the remaining ENONPMTOKEN failure path