ci: remove registry-url from setup-node — fixes OIDC Trusted Publisher flow

Author: BenGlut

.github/workflows/publish.yml

@@ -42,13 +42,12 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
+          # No registry-url — setup-node would inject an .npmrc _authToken line that
+          # sends an empty Bearer header and blocks npm's OIDC Trusted Publisher flow.
 
       - name: Install dependencies (skip optional native modules)
         run: npm ci --omit=optional
 
-      - name: Publish with provenance
+      - name: Publish with provenance (OIDC Trusted Publisher — no token needed)
         run: npm publish --access public --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}