ci: fix publish job by moving npm release to OIDC trusted publishing

[Copilot]

Description

The publish GitHub Actions job was failing on release tags with npm publish returning E404/permission-not-found for @mia-platform/lc39. This updates the workflow to use npm trusted publishing (GitHub OIDC) for the release publish path.

• Root cause

  • Publish relied on token-based auth in the workflow; npm rejected publish for the scoped package during tag release.

• Workflow changes

  • Added explicit job permissions required for OIDC:
    • contents: read
    • id-token: write

• Publish command update

  • Switched publish invocation to provenance-enabled trusted publishing and removed explicit token env on the step.

permissions:
  contents: read
  id-token: write

- run: npm publish --access public --provenance --tag ${{ steps.npm-tag.outputs.tag }}

Checklist

• your branch will not cause merge conflict with master
• run npm test
• tests are included
• the documentation is updated or integrated accordingly with your changes
• the code will follow the lint rules and style of the project
• you are not committing extraneous files or sensible data