SAN: publish @linqapp/cli to npm via OIDC trusted publishing

[abhiramkast]

Problem

The CLI is only distributed via curl | sudo install today. Enterprise / corp-network users get blocked on unsigned curl-pipe-sh, and we have no npm channel for devs. We also have no provenance signing on releases.

Solution

Enable npm publishing on every main release via npm's OIDC Trusted Publishing — no NPM_TOKEN secret needed, provenance attestations attached automatically.

• Flip @semantic-release/npm to npmPublish: true.
• Add id-token: write permission so GitHub issues an OIDC token for the workflow.
• Drop NPM_TOKEN from the env block.
• Pin npm to latest in CI (Trusted Publishing requires npm CLI ≥ 11.5.1; Node 22 LTS doesn't always ship that).

Pre-merge requirement

Register the trusted publisher on npmjs.com before this PR is merged. Once merged, the next release will try to publish via OIDC immediately — if the trusted publisher isn't registered yet, that release fails the auth handshake.

At https://www.npmjs.com/package/@linqapp/cli → Settings → Trusted Publishers:

• Organization: linq-team
• Repository: linq-cli
• Workflow filename: release.yml
• Environment: (leave blank)
• Allowed actions: npm publish

Confirm registration is saved, then this PR can be merged. The NPM_TOKEN GitHub Actions secret can be deleted after the first successful publish.

🔗 Linear Issue

[abhiramkast]

Done by Josh in a different PR