ci: sync the release workflow on v2/main with main's verbatim

[cliffhall]

Closes #1902

Surfaced while building the v2.1.0 milestone-merge resolution branch (#1903): after resolving all eight conflicts, .github/workflows/main.yml was the only file where the merged tree still differed from v2/main.

The question this answers

Rather than forward-port the three commits hunk by hunk, I diffed the file both directions first. v2/main has nothing main lacks — its only unique content is the superseded publish step:

        run: npm publish --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

which is precisely what #1836 replaced. Every other line already matched. So this is a verbatim copy of main's file — fewer ways to get it wrong than reconstructing hunks, and it leaves the two branches byte-identical.

What v2/main gains

From	Change
#1831	least-privilege default permissions: contents: read for GITHUB_TOKEN
#1834	dist-tag derived from the version, so a -rc can't publish to latest
#1836	npm OIDC trusted publishing (id-token: write + environment: release)

That last one matters most: v2/main's copy authenticated with NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} against a secret this repo does not have, which writes an empty _authToken into the generated .npmrc and fails ENEEDAUTH before OIDC is ever attempted.

Nothing was actually broken — releases are cut from main, which has the good copy — but v2/main's is the one every future PR edits, so the divergence was a live trap.

Not a back-merge

Only this one file is taken from main. None of main's pre-swap v1 lineage enters v2/main's ancestry, so the #1868 reasoning is respected.

Verification

• git diff origin/main -- .github/workflows/main.yml on this branch is empty — the two are now byte-identical.
• YAML parses (yaml.safe_load).
• The heavier gates are deliberately not cited as evidence here: this changes only a GitHub Actions workflow file, which validate / coverage / smoke / Storybook do not read or execute. The content's real proof is that it is the exact file main has been publishing 2.0.0 with.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

[Copilot]

Pull request overview

This PR updates v2/main’s release workflow (.github/workflows/main.yml) to match the main branch’s current publishing behavior, removing the stale NPM_TOKEN-based publish path and aligning v2/main with the OIDC trusted publishing + dist-tag safeguards already used on releases cut from main.

Changes:

• Adds a workflow-level least-privilege default GITHUB_TOKEN permission (contents: read), with publish jobs explicitly overriding as needed.
• Ensures the publish job upgrades npm to a version that supports OIDC trusted publishing (npm >= 11.5.1).
• Switches npm publishing to explicitly derive and pass the dist-tag (next for prereleases, latest otherwise) and removes the NODE_AUTH_TOKEN secret usage.

[cliffhall]

Copilot review round 1 on `10ec5bdc`: no comments — no inline findings, no suppressed nits, and the overview reads the change correctly (least-privilege default token, npm ≥ 11.5.1 for OIDC, dist-tag derivation, removal of the NODE_AUTH_TOKEN path).

Nothing to respond to, so no changes pushed — the branch is still byte-identical to main's copy, which is the whole point of the PR. Ready for a maintainer approval.