ci: publish through npm trusted publishing (#42)

The release job gets `id-token: write` and no longer takes an npm token.
`registry-url` goes with it: `setup-node` writes an `.npmrc` with an
`_authToken` placeholder for it, and that placeholder shadows OIDC.

Author: dangreen

.github/workflows/release.yml

@@ -39,6 +39,9 @@ jobs:
     name: Release
     needs: check
     if: needs.check.outputs.workflow == 'release'
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v7
@@ -51,12 +54,10 @@ jobs:
         with:
           node-version: 24
           cache: 'pnpm'
-          registry-url: 'https://registry.npmjs.org'
       - name: Install dependencies
         run: pnpm install
       - name: Release
         uses: trigensoftware/simple-release-action@latest
         with:
           workflow: release
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          npm-token: ${{ secrets.NPM_TOKEN }}