Switch npm publish to OIDC trusted publishers

[clholgat]

Summary

• Remove NPM_TOKEN secret dependency from both publish jobs
• Add --provenance flag to npm publish for OIDC-based authentication
• Add environment: npm-publish to both publish jobs (required for OIDC token claims)

Setup required before merging

1. npmjs.com — configure trusted publisher on both @snap/valdi and @snap/eslint-plugin-valdi:
   • Repository owner: Snapchat
   • Repository name: Valdi
   • Workflow filename: publish-npm.yml
   • Environment: npm-publish
2. github.com/Snapchat/Valdi — create an environment named npm-publish (Settings > Environments)

Test plan

• Create npm-publish environment on the repo
• Configure trusted publisher on npmjs.com for @snap/valdi
• Configure trusted publisher on npmjs.com for @snap/eslint-plugin-valdi
• Merge and trigger a workflow_dispatch run to verify publish succeeds

🤖 Generated with Claude Code

[github-actions]

📊 PR Size: size/S

Total changes: 10 lines (1 files)

Top files changed:

• .github/workflows/publish-npm.yml: +4 -6

_{Size calculated as additions + deletions. Labels: XS (<10), S (<50), M (<250), L (<1000), XL (1000+)}