Fix Release CI: switch npm publish to trusted publishing (OIDC)

[zamderax]

Problem

The Release workflow failed on the last two pushes to main (merges of #12 and #13) with npm ... failed with exit code 1 in the changesets publish step.

Root cause: the repo has no NPM_TOKEN secret (gh secret list is empty), but the workflow passes secrets.NPM_TOKEN to changeset publish, so npm publish fails with an auth error. The npm publish timestamps show every past release (1.0.6–1.0.9) was published manually seconds-to-minutes after the push — the "green" Release runs were no-ops where the version was already on npm. CI publishing has never actually worked.

The build itself is fine: npm ci + npm run build pass at HEAD (verified locally on Node 24 / npm 11.6.2).

Fix

Switch to npm trusted publishing so CI needs no token and nothing ever needs rotating (npm revoked classic tokens in Dec 2025 and caps granular write-token lifetimes):

• add id-token: write permission for OIDC
• bump the job to Node 24 (ships npm ≥ 11.5.1, required for trusted publishing; package engines allows ≥ 20)
• pre-create a plain ~/.npmrc so changesets/action doesn't write its token-based one, letting npm fall through to OIDC
• drop the dead NPM_TOKEN env reference

⚠️ Required one-time setup before merging

On npmjs.com, under @wendylabsinc/react-three-map settings, add a Trusted Publisher:

Field	Value
Organization/user	wendylabsinc
Repository	react-three-map
Workflow filename	release.yml
Environment	(leave blank)

Without this, the publish step will still fail.