ci: secure npm publishing with OIDC

[sriaradhyula]

Summary

• replace the long-lived NPM_TOKEN publish path with npm Trusted Publishing over GitHub Actions OIDC
• pin Node 24, npm 11.15.0, and actions/setup-node by commit SHA; disable release caching and add a publish timeout
• update all npm package repository metadata to the canonical caipe-io/caipe-cli URL required by npm trust validation
• document the one-time bootstrap and trusted-publisher settings for all five packages

Security properties

• no npm write credential is stored in GitHub
• npm receives short-lived, workflow- and environment-bound OIDC credentials
• contents remains read-only and id-token: write is scoped to the publish job
• npm provenance remains enabled

Validation

• actionlint .github/workflows/release.yml
• npm test -- --run (237 tests passed)
• package JSON parsing and git diff --check

Registry follow-up

The npm account must enable 2FA and each package must be bootstrapped once before npm permits Trusted Publisher configuration. Then configure caipe, caipe-darwin-arm64, caipe-darwin-x64, caipe-linux-arm64, and caipe-linux-x64 to trust caipe-io/caipe-cli, workflow release.yml, environment npm-publish, action npm publish, and disallow token publishing.