fix: make npm trusted publishing tokenless in CI

[manthan787]

Summary

• force npm trusted publishing to run tokenless by clearing NODE_AUTH_TOKEN and NPM_TOKEN in publish step
• remove npm auth token config before publish to avoid stale/revoked token usage
• upgrade npm to v11.5.1+ in publish job for current trusted-publishing behavior
• document troubleshooting note in README

Why

The release 0.2.1 publish failed with:

• Access token expired or revoked
• E404 Not Found - PUT https://registry.npmjs.org/@runbook-agent%2frunbook

Workflow logs showed NODE_AUTH_TOKEN was set during publish, causing token-based auth path instead of clean OIDC trusted publishing.

Validation

• npm run typecheck