ci: publish via OIDC, so no npm token has to exist (#3)

The publish workflow added yesterday needed an NPM_TOKEN secret. Trusted
publishing removes that requirement entirely: the workflow exchanges a
short-lived, workflow-scoped OIDC credential with npm at publish time, so
nothing long-lived is stored and there is no secret to leak or rotate.

Two things this workflow would have failed on, from the npm docs:

- Node 22 bundles npm 10.x, but trusted publishing requires npm >= 11.5.1.
  Node 24 ships npm 11, so the runtime is bumped rather than adding a
  separate npm upgrade step.
- `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` passed an empty string with no
  secret set. The documented OIDC example sets no token at all — the
  `id-token: write` permission already present is what does the work.

Provenance stops needing the flag: npm generates attestations automatically
for a public package published from a public repo via OIDC.

Matches the identical change in ai-forms, so the two libraries keep releasing
the same way.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: catomean

.github/workflows/publish.yml

@@ -18,7 +18,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          # npm >= 11.5.1 is required for trusted publishing (OIDC); Node 24 ships it.
+          node-version: '24'
           registry-url: 'https://registry.npmjs.org'
 
       - run: npm ci --ignore-scripts
@@ -37,6 +38,7 @@ jobs:
             exit 1
           fi
 
+      # No token: id-token above lets the CLI exchange a short-lived OIDC
+      # credential with npm. Provenance is generated automatically for a public
+      # package from a public repo, so --provenance is not needed either.
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}