ci: migrate npm releases to trusted publishing

[kevinlee11]

Describe the problem this PR addresses

Maker releases currently depend on a long-lived npm token. npm no longer accepts the existing token, preventing new package versions from being published.

Describe the changes in this PR

The release workflow now authenticates to npm through GitHub Actions OIDC and the package's configured trusted publisher. It also uses a supported Node.js and semantic-release runtime, current GitHub Actions, and explicit repository metadata required by npm.

Other information

The npm trusted publisher is configured for square/maker, release.yml, and the npm publish permission. Dependency installation and the package, Lab, and Styleguide builds were validated under Node.js 24.

AI Usage

• AI assisted this PR (tools: Cursor)

Made with Cursor

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

Deployed Styleguide and Lab.

Notes

1. Links may take a few minutes to update after PR is opened or commit is pushed.
2. Links may become invalidated after PR is merged or closed.
3. Links for all releases and open PRs can be found on the Maker Deploys page.

[github-actions]

🎉 This PR is included in version 19.10.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀