ci(publish): switch to npm trusted publisher (OIDC), remove NPM_TOKEN

[0xkkkn]

Summary

Removes the NODE_AUTH_TOKEN env var from the publish step and relies on npm's Trusted Publisher (OIDC) flow. The npm-side trust between @privara/sdk and this repo's publish.yml is already configured.

Why

The previous NPM_TOKEN secret (Automation token) expired after ~2 months. The workflow run for v0.2.1 failed at the publish step:

npm error 404 Not Found - PUT https://registry.npmjs.org/@privara%2fsdk - Not found
npm error 404  '@privara/sdk@0.2.1' is not in this registry.

Trusted Publishers replaces the static long-lived token with a per-run OIDC token issued by GitHub Actions. No secrets to rotate, no expirations.

What

• Removes the env: NODE_AUTH_TOKEN block from the publish step in .github/workflows/publish.yml.
• All other steps (lint/typecheck/test/build) unchanged.
• permissions: id-token: write is already in place.

Test plan

• After merge, force-update tag v0.2.1 to point at this commit (or push a new tag) — workflow re-runs with OIDC and publishes @privara/sdk@0.2.1.
• Optionally delete the old NPM_TOKEN secret from repo settings (no longer used).

Linked

• Linear: DEV-132
• Failed run: https://github.com/PrivaraXYZ/privara-sdk/actions/runs/25508490147