Switch to trusted publishing and align CI workflows with ya-disk

[RomiC]

What changed

• Trusted publishing: replaced NPM_TOKEN secret with OIDC (id-token: write)
• Pinned actions to exact versions (checkout@v7.0.1, setup-node@v7.0.0)
• Test workflow: fixed branch trigger master → main, added permissions
• Both workflows: added npm run lint, npm run format:check, and npm run build to CI pipeline

Remaining manual step

After merge, add RomiC/ya-disk-stream as a Trusted Publisher on npmjs.com (package settings → Access → Trusted Publishers).

[coveralls]

Coverage is 100.0% — chore/trusted-publishing into main. No base build found for main.

[greptile-apps]

Greptile Summary

This PR switches npm publication from a repository token to OIDC trusted publishing and aligns the test and release workflows with the main branch and expanded validation.

• Grants the publishing job permission to request an OIDC token and removes NPM_TOKEN usage.
• Updates GitHub Action references to exact semantic versions.
• Adds formatting, linting, and build checks to the CI workflows.
• Corrects the test workflow’s push trigger from master to main.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/npm-publish.yml	Adds restricted workflow permissions, OIDC-based npm publishing, exact action versions, and lint/format validation before release.
.github/workflows/npm-test.yml	Corrects the tested branch, updates action versions, and adds formatting and build validation to the test matrix.

_{Reviews (2): Last reviewed commit: "Chore: Switch to trusted publishing and ..." | Re-trigger Greptile}