ci: publish to npm with trusted publishing (OIDC)

The v2.18.0 publish failed with E404 because npm rejected the
NPM_AUTOMATION_TOKEN. Authenticate through the trusted publisher
configured on npmjs.com instead, and add workflow_dispatch so a failed
publish can be re-run by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Snailedlt

.github/workflows/npm_publish.yml

@@ -2,6 +2,11 @@ name: "Publish to npm"
 on:
   release:
     types: [released]
+  # Allows re-running a failed publish by hand from the Actions tab
+  workflow_dispatch:
+permissions:
+  id-token: write # Required for npm trusted publishing (OIDC)
+  contents: read
 jobs:
   publish:
     environment: release
@@ -11,13 +16,15 @@ jobs:
         with:
           # "ref" specifies the branch to check out.
           # "github.event.release.target_commitish" is a global variable and specifies the branch the release targeted
+          # It's empty on manual runs, so the branch selected in the Actions tab is used instead
           ref: ${{ github.event.release.target_commitish }}
-      - name: Use Node.js v16
+      - name: Use Node.js v24
         uses: actions/setup-node@v4
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org/ # Specifies the registry, this field is required!
+      # Trusted publishing requires npm 11.5.1 or later
+      - run: npm install -g npm@latest
       - run: npm ci
+      # Authenticates through the trusted publisher configured on npmjs.com, so no token is needed
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTOMATION_TOKEN }}