ci: enable npm trusted publishing

[CakeRepository]

Switches publish.yml from the long-lived NPM_TOKEN secret to npm Trusted Publishing through GitHub OIDC.

Changes:

• grants id-token: write
• removes NODE_AUTH_TOKEN
• uses GitHub-hosted Node 24 and current npm CLI
• disables package-manager caching for the release job
• keeps version validation, duplicate-version protection, build, and tests
• adds a one-time push trigger so merging this PR performs a real v3.0.0 trusted-publishing test