ci: use trusted publishing for npm release

[sarveshsea]

Summary

• Moves the npm publish workflow to current trusted-publishing/OIDC defaults.
• Uses Node 24/npm 11+ for npm trusted publishing support.
• Keeps optional NPM_TOKEN fallback, but publishes without long-lived tokens when trusted publishing is configured.
• Uses npm ci instead of rewriting the lockfile during release.

Verification

• ruby YAML parse for .github/workflows/publish.yml passed.
• Prior 1.0.2 package gates passed before the publish auth failure.