chore(workflow): switch npm release to OIDC

[Himenon]

Summary

This PR migrates the npm release authentication from a static NPM_TOKEN (secret) to OpenID Connect (OIDC) via GitHub's Trusted Publishers.

Changes

• Added id-token: write and contents: read permissions to the release-npm-registry job.
• Removed the dependency on secrets.NPM_TOKEN.
• Maintained NPM_CONFIG_PROVENANCE=true for secure package publishing.

Impact

• Security: No longer requires managing long-lived npm tokens in GitHub Secrets.
• Workflow: Authentication is now handled automatically by GitHub's OIDC provider.