ci: drop registry-url from setup-node so OIDC handles auth

setup-node@v4 with registry-url writes a legacy .npmrc with always-auth=true
which prevents npm 11.x from attempting OIDC token exchange. Without
registry-url, npm falls through to OIDC trusted publisher properly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Habirua

.github/workflows/publish.yml

@@ -22,15 +22,15 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
 
       - name: Upgrade npm (OIDC trusted publisher requires npm 11.5.1+)
         run: |
           npm install -g npm@latest
-          which npm
           npm --version
-          node --version
+
+      - name: Configure npm registry (no auth — OIDC will handle it)
+        run: npm config set registry https://registry.npmjs.org/
 
       - run: npm ci
 
@@ -43,8 +43,4 @@ jobs:
         run: npm version ${{ github.event.inputs.version }} --no-git-tag-version
 
       - name: Publish to npm (OIDC)
-        run: |
-          npm --version
-          npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ''
+        run: npm publish --provenance --access public