Migrate npm publishing to OIDC

[seveibar]

Summary

• grant GitHub Actions OIDC permission for npm trusted publishing
• remove the legacy npm token from the release step
• use Node 24 with actions/setup-node v6
• add explicit repository metadata where missing

Validation

• parsed the release workflow as YAML
• parsed package.json
• ran git diff --check
• confirmed the release workflow no longer references NPM_TOKEN

[tscircuitbot]

---

Thank you for your contribution! 🎉

PR Rating: ⭐
Impact: Tiny

Track your contributions and see the leaderboard at: tscircuit Contribution Tracker

---