v1.2.0: Use OIDC trusted publishing instead of long-lived NPM_TOKEN

Remove .npmrc token injection in favor of npm CLI's automatic OIDC
detection. The workflow already has id-token: write permission.