release: migrate npm publication to Trusted Publishing OIDC

[pitimon]

Problem

The post-merge npm workflow for 0.39.51 reached npm publish but the registry returned E404 on the package PUT. The repository NPM_TOKEN was copied from the local granular token, but that token is IP-restricted for local release recovery and cannot authenticate from a GitHub-hosted runner.

Evidence:

• failed publish run: https://github.com/pitimon/TokenTracker/actions/runs/31217931621
• local authenticated publish of 0.39.51: succeeded
• rerun after registry publication: succeeded and the exact-package smoke test passed
• registry artifact: version 0.39.51, Node >=20.18.1, Undici 7.29.0, production audit 0

No token value or allowed IP range is recorded here.

Durable fix

Migrate .github/workflows/npm-publish.yml to npm Trusted Publishing/OIDC:

1. On npmjs.com, configure the package trusted publisher for:
   • GitHub owner/user: pitimon
   • repository: TokenTracker
   • workflow filename: npm-publish.yml
   • allowed action: npm publish
2. Use Node >=22.14 and npm >=11.5.1 in the publish job.
3. Grant the publish job id-token: write and contents: read.
4. Remove NODE_AUTH_TOKEN/NPM_TOKEN from the publish step.
5. Publish a patch version from GitHub Actions and verify the registry smoke receipt.
6. Remove the unusable GitHub NPM_TOKEN secret after OIDC is proven.

Acceptance criteria

• A new version is published by the GitHub-hosted workflow without a long-lived npm token.
• Provenance is present for the registry artifact.
• Fresh registry install and semantic dashboard/CLI smoke pass.
• The old GitHub secret is removed only after successful OIDC publication.

[pitimon]

Reopened: PR #182 correctly removed NPM_TOKEN and added id-token: write, but the live main publish run 31250122920 failed at npm publish with E404. Direct npm trust configuration also failed (E403) because the locally configured granular access token bypasses 2FA, which npm forbids for trust operations. No package version was published (registry remains 0.39.51).

Completion blocker: package owner must configure the GitHub trusted publisher in npm with an interactive 2FA-backed npm session (package @ipv9/tokentracker-cli; repository pitimon/TokenTracker; workflow npm-publish.yml; publish permission), then rerun the workflow. This issue remains open until an OIDC publish and provenance/artifact verification pass.