ci(publish): migrate npm publish to OIDC trusted publishing

Drops the legacy publish token. npm trusted publisher trust is
now registered on npmjs.com (Sharp-API/sharpapi-ts → publish.yml),
which lets `npm publish --provenance` pick up the GitHub OIDC token
automatically without any env token configured.

Matches sharpapi-python's PyPI trusted-publishing setup (no long-
lived secret there either). --provenance still emits the SLSA
attestation on each published version.

The workflow already had `id-token: write` and `--provenance` from
the release gating pass, so this commit just removes the
NODE_AUTH_TOKEN env block.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Mlaz-code

.github/workflows/publish.yml

@@ -53,7 +53,13 @@ jobs:
       - name: Publish to npm
         # Only publish on an actual release event. workflow_dispatch
         # runs through test+build as a dry run but must not upload.
+        #
+        # Trusted publishing (OIDC): npm picks up the GitHub OIDC token
+        # automatically when no _authToken is configured. The trust is
+        # registered at
+        #   https://www.npmjs.com/package/@sharp-api/client/access
+        # (Trusted Publishers → Sharp-API/sharpapi-ts → publish.yml).
+        # Drops the long-lived NPM_TOKEN secret that previously backed
+        # this step. --provenance still emits the SLSA attestation.
         if: github.event_name == 'release'
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}