Re-cut of 2.6.1 with the OIDC publish workflow at HEAD. 2.6.1 was
tagged before the trusted-publishing switch landed and never published
to npm.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>