Migrate npm publishing to OIDC

[seveibar]

Summary

• grant GitHub Actions OIDC permission for npm trusted publishing
• remove the legacy npm token from the release step
• use Node 24 with actions/setup-node v6
• add explicit repository metadata where missing

Validation

• parsed the release workflow as YAML
• parsed package.json
• ran git diff --check
• confirmed the release workflow no longer references NPM_TOKEN