Use trusted npm publishing

[kevmo314]

What changed

• grant the npm publishing job GitHub OIDC token permission
• run releases on Node 24 with an explicitly OIDC-capable npm 11 CLI
• remove the expired NPM_TOKEN credential from the publish step
• add the repository metadata npm validates against the trusted publisher
• make the Rollup config compatible with Node 24 while preserving the same output paths

Why

The 1.2.4 release builds successfully, but npm rejects the repository's legacy token. The package is now configured on npm for trusted publishing from muxable/rtirl-obs via npm-publish.yml, so the workflow must authenticate with GitHub OIDC instead.

Impact

Merging this PR triggers the workflow on main; if 1.2.4 is still unpublished, it will build and publish @rtirl/api@1.2.4 without a long-lived npm token.

Validation

• npm ci --ignore-scripts under Node 24.13.0 / npm 11.6.2
• npm run build
• npm pack --dry-run --json
• git diff --check

[github-actions]

Visit the preview URL for this PR (updated for commit 05f4ec4):

• https://rtirl-overlays--pr355-agent-trusted-npm-pu-und2ct44.web.app
• https://rtirl-editor--pr355-agent-trusted-npm-pu-l51voxy8.web.app

_{(expires Thu, 06 Aug 2026 03:05:54 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 97736d8937dc1c35fa9cd85e09c8e5539fc44d09}