ci(release): publish to npm through trusted publishing

The organisation's NPM_TOKEN secret no longer publishes: moxygen 2.2.0 was refused with a 404 on 18 October. npm now exchanges the release job's GitHub OIDC token for a short-lived publish credential, as sourcey's release already does, so no npm token is stored as a secret.

Signed-off-by: Kam <oss@0state.com>

Author: auscaster

.github/workflows/release.yml

@@ -125,24 +125,20 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: 24
-          registry-url: https://registry.npmjs.org
           cache: npm
 
       - uses: actions/download-artifact@v8
         with:
           name: moxygen-npm-package
           path: .stage/release
 
+      # npm trusted publishing: npm exchanges this job's GitHub OIDC token for a
+      # short-lived publish credential, so no npm token is stored as a secret.
       - name: Publish to npm
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           VERSION: ${{ needs.validate.outputs.version }}
         run: |
           set -eu
-          if [ -z "${NODE_AUTH_TOKEN:-}" ]; then
-            echo "NPM_TOKEN secret is required to publish to npm" >&2
-            exit 1
-          fi
           if npm view "moxygen@${VERSION}" version >/dev/null 2>&1; then
             echo "moxygen@${VERSION} already exists on npm; skipping publish"
             exit 0