docs: align npm trusted publishing setup

[hopeatina]

Summary

• Update publish workflow to current npm trusted-publishing action versions.
• Add a runtime node/npm version check to release logs.
• Document the exact npm trusted-publisher settings required for this package, including allowed action and empty environment.

Verification

• npm run type-check
• npm test
• npm run build
• npm pack --dry-run --json
• git diff --check

Context

The v0.1.0-alpha.2 release built successfully but failed at npm publish with E404/not permitted. This PR removes repo-side release workflow drift and documents the remaining npm package trusted-publisher setting to verify.