fix: update CI pipelines, Node 26.x, OIDC npm auth, fix broken badges

[Farenheith]

Summary

Fixes broken README badges and updates GitHub Actions workflows to latest versions.

Badges Fixed

• Removed CodeClimate badges (test_coverage, maintainability) — service shut down, returns 301
• Removed david-dm.org Packages badge — service decommissioned (returns 500)
• Kept working Action badges (build, test, lint) and npm version badge

Pipeline Updates

• Updated actions/checkout to v7 (latest: v7.0.1)
• Updated actions/setup-node from v3/v1 to v7 (latest: v7.0.0)
• Updated supercharge/redis-github-action to v1.8.1 (latest: 1.8.1)
• Upgraded Node.js from 16.x to Node 26.x (latest LTS, v26.7.0) across all workflows
• Removed CodeClimate coverage action — test workflow now runs npm run test:coverage directly
• Added modern permissions block with id-token: write

Semantic Release — OIDC Only

Replaced NPM_TOKEN secret with proper OIDC token exchange for npm authentication:

1. Request scoped OIDC token from GitHub Actions (audience=https://registry.npmjs.org)
2. Exchange it for an npm access token via /-/npm/v1/oauth/token
3. Write short-lived token to ~/.npmrc

This eliminates the need to store a long-lived NPM_TOKEN secret — token is generated on-demand and expires automatically.

Files Changed

• .github/workflows/build.yml
• .github/workflows/test.yml (removed CodeClimate, kept coverage)
• .github/workflows/lint.yml
• .github/workflows/semantic.yml (OIDC auth)
• .github/workflows/test-e2e.yml
• README.md