Migrate npm publishing workflow to trusted publishing via OIDC

The npm package configuration is already prepared for trusted
publishing, so the release workflow should stop relying on long-
lived NPM tokens. This updates the GitHub Actions release job to
use OIDC permissions with direct `npm publish`, removes temporary
`.npmrc` token setup, and refreshes checkout/setup-node actions
while keeping the tag-driven release flow intact.

Constraint: npm trusted publishing validates the exact GitHub workflow filename and requires `id-token: write`
Constraint: Trusted publishing requires npm CLI support and a sufficiently new Node runtime in CI
Rejected: Keep token-based publish as fallback in the same workflow | defeats the security goal and complicates release diagnostics
Confidence: high
Scope-risk: narrow
Directive: Keep publish authentication tokenless in CI; if future installs need auth, use separate read-only credentials only for install steps
Tested: Release workflow file reviewed against npm trusted publisher requirements; local package/docs verification already green on the tagged candidate
Not-tested: GitHub Actions trusted publish end-to-end until the updated tag is pushed and the workflow runs

Author: Clickin

.github/workflows/release.yml

@@ -12,14 +12,14 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '22'
+          node-version: '24'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Setup pnpm
@@ -36,13 +36,9 @@ jobs:
       - name: Build package
         run: pnpm build
 
-      - name: Create .npmrc
-        run: |
-          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
-          echo "registry=https://registry.npmjs.org/" >> ~/.npmrc
-
       - name: Publish to NPM
-        run: pnpm --filter=stax-xml publish --access public --no-git-checks
+        working-directory: packages/stax-xml
+        run: npm publish --access public
 
       - name: Generate changelog
         run: pnpm dlx changelogithub