ci: Use npm trusted publishing for web UI

[franciscojavierarceo]

What this PR does

• enables GitHub OIDC permissions for the release workflow and reusable Web UI publish workflow
• binds the npm publish job to the production environment configured as the package trusted publisher
• uses Node 22.14.0 and npm 11.5.1, which support npm Trusted Publishing
• removes the long-lived NPM_TOKEN/NODE_AUTH_TOKEN publish path

Why we need it

The npm package is configured with a trusted publisher for publish.yml and the production environment, but the workflow was still publishing with an npm token and did not request an OIDC token. This aligns the workflow with the npm package settings and keeps the reusable workflow compatible with the parent publish.yml caller.

Validation

• actionlint .github/workflows/publish.yml .github/workflows/publish_web_ui.yml
• Ruby YAML parsing for both workflow files
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 26acfd05cb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".