fix(ci): switch npm publish to OIDC provenance (repo is now public)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: mariomeyer

.github/workflows/release.yml

@@ -48,6 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -56,13 +57,14 @@ jobs:
           node-version: 22
           registry-url: https://registry.npmjs.org
 
+      - name: Upgrade npm
+        run: npm install -g npm@latest
+
       - name: Publish CLI to npm
         working-directory: cli
         run: |
           npm version ${{ needs.release.outputs.new_release_version }} --no-git-tag-version
-          npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          npm publish --access public --provenance
 
   # Build each platform natively per stack (no QEMU emulation)
   build: