ci(release): publish to npm via OIDC trusted publishing (#158)

Drops the NPM_TOKEN secret from the publish step. Yarn 4.10.3 mints a
short-lived npm credential from the Actions ID token when no npmAuthToken
is configured, so the existing `yarn npm publish --provenance` call keeps
working unchanged.

Author: 0xisk

.github/workflows/release-publish.yml

@@ -1,3 +1,6 @@
+# Publishes to npm via OIDC trusted publishing, not a token.
+# Each package must list this repo and this workflow file as a Trusted
+# Publisher on npmjs.org, or the publish step fails to authenticate.
 name: Publish Release
 
 on:
@@ -29,7 +32,7 @@ jobs:
 
     permissions:
       contents: write   # push the version tag
-      id-token: write   # npm provenance
+      id-token: write   # mint the npm OIDC credential and the provenance statement
 
     steps:
       - name: Get github app token
@@ -156,9 +159,6 @@ jobs:
           fi
 
       - name: Publish to npm
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
-          yarn config set npmAuthToken "$NPM_TOKEN"
           cd packages/${{ steps.pkg.outputs.dir }}
           yarn npm publish --access public --provenance --tag ${{ steps.pkg.outputs.dist_tag }}