ci: publish to NPM through trusted publishing (#399)

The release job had no NPM credentials at all since NPM_TOKEN was dropped
in 3690bd1, so `changeset publish` failed with ENEEDAUTH for every package
once the devEngines blocker was out of the way. The changesets action
logged it plainly: "No NPM_TOKEN or OIDC available - assuming npm is
already authenticated".

Grant the job an OIDC token so the action takes its trusted publishing
path instead, which needs no long-lived token. Declaring permissions
narrows them from the permissive default, so the contents and
pull-requests scopes the action already used are spelled out as well.

Requires a trusted publisher configured on npmjs.com for each published
package, pointing at this repository and this workflow file.


Claude-Session: https://claude.ai/code/session_01P2UZcjV4P98WFjzfRfLQvx

Co-authored-by: Claude <noreply@anthropic.com>

Author: kraenhansen

.github/workflows/release.yml

@@ -22,6 +22,13 @@ jobs:
     name: Release
     runs-on: macos-latest
     environment: main
+    # Publishing to NPM happens through trusted publishing, which needs an OIDC
+    # token. Declaring permissions at all narrows them to exactly what is listed,
+    # so the two the changesets action already relied on are spelled out too.
+    permissions:
+      contents: write # version commits, git tags and GitHub releases
+      pull-requests: write # the "Version Packages" pull request
+      id-token: write # NPM trusted publishing
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4