🔧 Repository: migrate from NPM_TOKEN to Trusted Publishing (OIDC)

Our current publish workflows rely on injecting a long-lived `NPM_TOKEN` secret (associated with @Rugvip).

npm now supports [Trusted Publishing](https://docs.npmjs.com/trusted-publishers), which authenticates via OIDC rather than static tokens:

> Trusted publishing creates a trust relationship between npm and your CI/CD provider using OIDC. When you configure a trusted publisher for your package, npm will accept publishes from the specific workflow you've authorized, in addition to traditional authentication methods like npm tokens and manual publishes. The npm CLI automatically detects OIDC environments and uses them for authentication before falling back to traditional tokens.

By moving to this model, our publish workflows would no longer need to inject an `NPM_TOKEN`. GitHub Actions would request a short-lived credential at runtime, scoped only to the workflow we’ve authorized in npm.

I’m opening this issue as I believe this may be a good direction to head - as publishing would be associated with the repository/workflow rather than an individual user's token.

Inspect the repository's publish workflows and the npm Trusted Publishing documentation linked in the issue. Identify every workflow that injects NPM_TOKEN, determine the authorized repository/workflow relationship in npm, and verify that publishing succeeds with GitHub Actions OIDC and no long-lived token.

Written by the indexing model from the issue text.