updates to release process

[shrutiburman]

Fixes

https://github.com/twilio/twilio-node/actions/runs/30337939131?pr=1196
Migrate npm publishing to OIDC trusted publishing.

New Release flow-
[Librarian]git tag vX.Y.Z && git push --tags →
[Github Actions] test → approve [Manual] → GitHub Release → publish to npm

deploy.yml — New release workflow (replaces test-and-deploy.yml's publish path)

• Keyless publish via npm OIDC trusted publishing — no more long-lived NPM_TOKEN
• Triggered on tag push (v*), not manual release creation
• Tests on Node 22 + 24, then gates on production environment approval
• Creates GitHub Release automatically (with generated notes)
• Validates tag format matches package.json before publishing
• Emits npm native provenance (--provenance)
• Prerelease tags (e.g. v1.2.3-rc.1) auto-route to next dist-tag
• Dependencies resolved through curated Artifactory via twilio/sdk-actions/artifactory-oidc

.github/workflows/ci.yml — Weekly release-readiness check

• Runs every Monday 9AM IST + manual dispatch
• Validates lockfile hygiene (no internal Artifactory hosts)
• Full test + build pipeline on ubuntu-x64
• Exercises the entire publish path up to (but not including) actual publish
• Slack notification on cron failure
• Catches platform team breakages (OIDC trust, runner group, Artifactory) before release day

Also in this PR

• Committed package-lock.json with all resolved URLs rewritten to registry.npmjs.org
• Removed package-lock.json from .gitignore
• Deleted local .github/artifactory-oidc/ composite action (replaced by shared
  twilio/sdk-actions/artifactory-oidc)
• Added release-plan.md documenting the end-to-end release flow and platform dependencies

Prerequisites (must be in place before first real release)

• Repo added to Artifactory OIDC trust (trusted_builds) — SSC team
• Repo added to ubuntu-x64 runner group — Enterprise admin
• npm trusted publisher registered for twilio package pointing to deploy.yml + production
  environment
• vars.ARTIFACTORY_URL set to https://twilio.jfrog.io
• production GitHub environment created with required reviewers

Checklist

• I acknowledge that all my contributions will be made under the project's license
• I have made a material change to the repo (functionality, testing, spelling, grammar)
• I have read the Contribution Guidelines and my PR follows them
• I have titled the PR appropriately
• I have updated my branch with the main branch
• I have added tests that prove my fix is effective or that my feature works
• I have added the necessary documentation about the functionality in the appropriate .md file
• I have added inline documentation to the code I modified

If you have questions, please file a support ticket, or create a GitHub Issue in this repository.

[shrutiburman]

We should be using uses: sendgrid/dx-automator/actions/release@main release here but that is currently blocked

Tradeoff-
gh release create --generate-notes: auto-generates notes from PR titles and commit messages since the last tag. No changelog file involved.
dx-automator/actions/release: reads CHANGES.md (or CHANGELOG.md) in the repo, finds the section matching the release version, and uses that as the release body. So the release notes on GitHub match exactly what's written in the changelog file.

[shrutiburman]

test run
throws exception from inside the action, as expected