Use OIDC for npm publish

[jakubno]

Note

Updates the release workflow to Node.js 22 and switches npm publishing to OIDC by granting id-token and removing the NPM_TOKEN secret.

• CI/CD: Release workflow (.github/workflows/release.yml)
  • Node.js / Actions:
    • Upgrade actions/setup-node to v6 and Node version to 22.x across jobs.
    • Set registry-url where missing; keep pnpm caching.
  • Authentication:
    • Grant permissions: id-token: write.
    • Set NPM_TOKEN to an empty string to enable OIDC-based npm publish via Changesets.
  • Tooling:
    • Add step to update npm to ^11.6 during release job.
  • Misc:
    • Minor step renames/ordering; no functional changes to job matrix or release logic.

^{Written by Cursor Bugbot for commit 124ce8e. This will update automatically on new commits. Configure here.}

[linear]

ENG-3226 Use oidc for npm publish