feat(release): publish to npm without a token, via OIDC

[navbytes]

Summary

@navbytes/vee now publishes through npm trusted publishing. The registry
verifies this workflow's OIDC identity instead of a stored credential, so there
is no NPM_TOKEN to leak, to rotate, or to forget.

Configured on the package: publisher GitHub Actions, repository
navbytes/vee, workflow release.yml, permission npm publish.
Nothing else can publish it.

Why, beyond tidiness

v0.3.0 failed to publish twice, both times because of how npm treats tokens:

1. A granular token without 2FA bypass is rejected outright — npm error code EOTP: This operation requires a one-time password. No CI can answer
   that.
2. A token with bypass has its publishes staged for manual confirmation.
   That is why the job reported + @navbytes/vee@0.3.0 while the registry
   returned {"error":"Not found"} — the package existed with zero versions.

npm is restricting bypass tokens for direct publishing regardless (it warns
about it in the publish output), so the token path was on its way out. OIDC
sidesteps all of it.

It also removes a 90-day expiry. npm caps write tokens there with no "never
expires" option, so the token was guaranteed to lapse and take a future release
with it — the same shape as the Homebrew tap sitting two releases stale.

Changes

• NODE_AUTH_TOKEN and the missing-token guard are gone; there is no credential
  to check for.
• --provenance dropped — attestation is automatic under OIDC. Verified the
  0.3.0 publish already carries a SLSA provenance predicate.
• id-token: write unchanged; it is what OIDC needs.
• The already-published guard stays, so a re-run still skips a version that is
  live rather than failing on it.

Requirements met

npm trusted publishing needs npm >= 11.5.1. Node 24 ships npm 11.17, and the
job already pins node-version: 24.

Follow-ups, deliberately not in this PR

1. Delete NPM_TOKEN after a release proves OIDC works. Left in place for
   now so there is a fallback if something is misconfigured.
2. Tighten "Publishing access" on the package to "Require two-factor
   authentication and disallow bypass 2fa tokens". npm notes trusted publishers
   keep working under any setting and recommends the most restrictive one — but
   sequencing matters: prove OIDC first, then remove the other door.

Type of change

• New feature (non-breaking change that adds functionality)

Testing done

• release.yml validated as YAML; no NPM_TOKEN reference remains.
• Confirmed @navbytes/vee@0.3.0 is live, installs, and all three builders work
  from the published package.
• Confirmed the published version already carries a provenance attestation.

The publish path itself is only exercised by a real release — that is the next
one.

https://claude.ai/code/session_0159CBiPNW97Nnn9oDyk7VyP