ci: keep npm release install compatible

[sarveshsea]

Summary

• Keeps the trusted-publishing release workflow from ci: use trusted publishing for npm release #27.
• Uses npm install --ignore-scripts for the release workflow because npm 11 strict npm ci rejects the existing lockfile optional native package shape.
• Avoids deleting package-lock.json during release.

Verification

• ruby YAML parse for .github/workflows/publish.yml passed.
• Publish run 25865808778 confirmed the failure was npm ci lockfile strictness before package checks.