npm Trusted Publishing is configured on the package, so the npm job
authenticates with the OIDC token from id-token: write, exactly as the PyPI job
does. NODE_AUTH_TOKEN is gone and no NPM_TOKEN secret is needed.

Removing it is not merely tidying: an empty NODE_AUTH_TOKEN is worse than an
absent one, because npm would authenticate as nobody rather than falling through
to OIDC.

The whole release path now references zero secrets. Both registries verify the
repository, the workflow filename and the tag through claims GitHub mints at run
time, and both attach provenance attestations so an installer can check that a
given artifact came from this workflow.

As a side effect the package can also take npm's "require 2FA and disallow
bypass-2fa tokens" setting, which a CI token would have forced us to opt out of.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>