fix: Node 24 + OIDC Trusted Publishing

[y1o1]

Summary

• Upgrade Node.js 22 → 24 across all workflows (CI + release)
• Node 24 ships npm 11.x+ with native OIDC Trusted Publishing support
• Remove NODE_AUTH_TOKEN / NPM_TOKEN secret — OIDC handles npm auth automatically via id-token: write permission

Context

Release workflows were failing with ENEEDAUTH because NPM_TOKEN secret was not set. With Trusted Publishers configured on npm, OIDC authentication is the correct approach.

Test plan

• CI should pass with Node 24
• Release workflow should publish via OIDC (verify on next tag push)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates GitHub Actions workflows to use Node.js 24 and switches npm publishing authentication from a secret-based token to OIDC Trusted Publishing, aligning releases with npm’s recommended GitHub Actions auth flow.

Changes:

• Bump Node.js version from 22 to 24 in CI and release workflows.
• Remove NODE_AUTH_TOKEN / NPM_TOKEN usage from the npm publish step to rely on OIDC (id-token: write).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/release.yml	Node 24 upgrade; removes token-based publish env in favor of OIDC permissions.
.github/workflows/ci.yml	Node 24 upgrade for CI execution.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

PR description states we’re relying on npm 11’s native OIDC Trusted Publishing support, but the workflow still publishes via pnpm publish. If pnpm’s publisher path doesn’t implement npm’s OIDC token exchange, this may still fail with ENEEDAUTH even on Node 24. Consider switching this step to npm publish --provenance ... (keeping pnpm for install/build), or document/verify that pnpm publish supports npm Trusted Publishing OIDC in GitHub Actions.