fix: enable npm provenance with OIDC trusted publishing

- Added OIDC comment documentation to workflow
- Prepares for signed npm packages with provenance

Author: Schero94

.github/workflows/semantic-release.yml

@@ -5,14 +5,18 @@ on:
     branches:
       - main
 
+# OIDC Trusted Publishing - No npm tokens needed!
+# npm trusts GitHub Actions directly via OIDC
+# See: https://docs.npmjs.com/generating-provenance-statements
+
 jobs:
   release:
     runs-on: ubuntu-latest
     permissions:
       contents: write
       issues: write
       pull-requests: write
-      id-token: write  # Required for npm provenance
+      id-token: write  # Required for OIDC trusted publishing
 
     steps:
       - name: Checkout