👷 [RUM-15055] fix release / publish pipeline issues from v0.1.2

[bcaudan]

Motivation

Two issues discovered after the v0.1.2 release:

1. npm publish 404: CI publishes were failing because an org-level NODE_AUTH_TOKEN secret seems to be present, preventing the OIDC Trusted Publishers exchange from running.
2. Changelog generation: git describe --tags was failing to find the last release because release tags are created on the release branch and are not ancestors of main. This caused the changelog to include all commits instead of only those since the last release. Additionally, squash-merged release PRs produce titles like v0.1.1 (#80) which the regex didn't match.

Changes

• Clear NODE_AUTH_TOKEN in the publish and dry-run steps so npm falls through to the OIDC Trusted Publishers exchange instead of using the invalid org secret
• Replace git describe --tags with a log scan to find the last release commit, making it resilient to tags not being ancestors of main
• Update RELEASE_COMMIT_RE to match squash-merged PR titles (e.g. v0.1.1 (#80))

Test instructions

1. Trigger the publish workflow with dry_run: true from a tag — the OIDC check step should succeed without falling back to the org token
2. Run node scripts/generate-changelog.ts --dry-run locally and verify the changelog only includes commits since the last release

Checklist

• Tested locally (playground)
• Added unit tests for this change.
• Added e2e/integration tests for this change.
• Updated related documentation.