fix: move canary publish to CD for npm trusted publishing

[spuppo-mux]

Summary

Canary publishes have been failing on every push to main (Example). Doing a similar approach to what we did for media chrome. Moved (created) canary step to cd.yml. Also removed unused token.

---

Note

Medium Risk
Touches production deployment workflows and npm publish paths; misconfigured gates could skip canaries or publish on the wrong commits, but application/runtime code is unchanged.

Overview
Canary npm publishes are moved out of ci.yml into a dedicated canary job in cd.yml, matching the media-chrome approach so publishes can use npm trusted publishing (OIDC via id-token: write and the production environment) instead of failing with token-based auth.

The CI build job no longer runs wet-run prerelease or requests id-token permissions—it only installs, cleans, and builds packages. The new CD job runs on main for non–Release Please commits (github-actions[bot] excluded), then ci → clean → build → wet-run canary prerelease with provenance.

The release Publish step in CD also drops the unused NODE_AUTH_TOKEN env var, aligning stable releases with the same trusted-publishing setup.

^{Reviewed by Cursor Bugbot for commit c07b550. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

@spuppo-mux is attempting to deploy a commit to the Mux Team on Vercel.

A member of the Team first needs to authorize it.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.