ci: publish to npm via trusted publishing

[vilenarios]

Why

NPM_TOKEN and the now-dead DEPLOY_PAT were both set on 2026-06-11. The 1.0.2 release failed at the git push, before the publish step ever ran — so there is currently no evidence NPM_TOKEN is still valid. Long-lived registry credentials are the failure mode that just cost us a release.

What

Grants id-token: write to the release job. @semantic-release/npm@13.1.5 already supports npm trusted publishing natively: it detects GitHub Actions, calls getIDToken("npm:registry.npmjs.org"), and exchanges it for a short-lived publish token. Publishes made this way also carry a provenance attestation.

Safety

verify-auth.js short-circuits only when the OIDC exchange succeeds:

if (await oidcContextEstablished(registry, pkg, context)) return
await setNpmrcAuth(npmrc, registry, context)

NODE_AUTH_TOKEN is left in place, so if the trusted publisher is not yet registered the plugin logs a failed exchange and falls back to the token exactly as today. This PR is therefore inert until the npmjs.com side is configured, and drops the token dependency the moment it is.

Follow-up (not in this PR)

• Register the trusted publisher for @ar.io/deploy on npmjs.com: repo ar-io/ar-io-deploy, workflow release.yml.
• Once a release succeeds over OIDC, delete the NPM_TOKEN secret and the NODE_AUTH_TOKEN line.
• Separately, the runner warns that actions/checkout@v4, setup-node@v4 and pnpm/action-setup@v4 are forced onto Node 24.