Migrate npm publish to Trusted Publishing (OIDC) — NPM_TOKEN confirmed broken

## Problem

`.github/workflows/publish.yml`'s `NPM_TOKEN` secret is confirmed broken — **twice**, on real publish attempts (`v1.3.0` and `v1.3.1` tag pushes, both failed with the same error):

```
npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/create-coliapp - Not found
```

Both times the actual publish had to be done manually (`pnpm publish` from a local machine, real npm account login + OTP) as a workaround — the CI path itself has never successfully published in this workflow's lifetime so far.

## Fix

Migrate off static-token auth entirely to npm's **Trusted Publishing** (OIDC-based, no long-lived secret to rotate or leak). `pnpm publish` already supports this via `--provenance` — verified directly against pnpm's own docs, not assumed from npm's behavior (per `pnpm-only.md`'s standing rule).

## Steps

1. **Manual, account-scoped (Thomas only, not doable by an agent)**: on `npmjs.com`, open `create-coliapp`'s package settings → Publishing access → add a **Trusted Publisher**, linking it to `colidevs/create-coliapp`'s `publish.yml` workflow.
2. **Workflow change** (ready to prepare once step 1 is done): add `permissions: id-token: write` to the `publish` job, drop the `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` env var, and add `--provenance` to the `pnpm publish` step.
3. Once merged, the `NPM_TOKEN` repo secret can be removed entirely — nothing left to rotate or leak.

## Why now, not urgent

Deprioritized by Thomas — the manual publish path works fine as a fallback in the meantime. Filed so it doesn't get lost, not because it's blocking anything.

Start with .github/workflows/publish.yml and the pnpm publish step; verify the package's Trusted Publisher setup and linked workflow first. The work is done when the publish job grants id-token: write, no longer references NPM_TOKEN, and publishes with --provenance, ready for a real tag publish.

Written by the indexing model from the issue text.