ci: use npm trusted publishing for releases

Remove NPM_TOKEN usage and publish via OIDC with provenance.

Made-with: Cursor

Author: proxymeshai

.github/workflows/release-npm.yml

@@ -34,9 +34,7 @@ jobs:
           fi
 
       - name: Install dependencies
-        run: npm ci
+        run: npm install --ignore-scripts
 
       - name: Publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --access public --provenance