Update npm workflow permissions and environment

[achamayou]

Use an environment, same as we do for pypi in #7879

[Copilot]

Pull request overview

This PR updates the NPM publish GitHub Actions workflow to align with the repository’s newer workflow pattern by using an explicit deployment environment and revised permissions configuration.

Changes:

• Switch workflow-level token permissions to read-all.
• Add a job-level environment: npm.
• Add a job-level permission granting id-token: write (for OIDC-based publishing).

Custom instructions used:

• .github/copilot-instructions.md
• .github/instructions/reviewing.instructions.md
• .github/instructions/changelog.instructions.md

[achamayou]

@copilot use the formatting skill

[Copilot]

@copilot use the formatting skill

I invoked the formatting skill as requested, but it is not available in this agent environment. I then ran a Prettier check directly on .github/workflows/npm.yml, and it is already correctly formatted (no diff). Commit: d77e14a. Screenshot: N/A (no UI changes).

[achamayou]

@copilot format the python code using ci-checks.sh -f

[Copilot]

@copilot format the python code using ci-checks.sh -f

Done in 6f1a337: I ran scripts/ci-checks.sh -f, installed uv in the runner environment so the Python checks could execute, and committed the resulting Python formatting changes. Screenshot: N/A (no UI changes).