fix(ci): drop registry-url from setup-node so OIDC trusted publishing works

The 1.1.0 release attempt — the first pure-OIDC publish after PR #11
dropped the bootstrap NPM_TOKEN — failed in
https://github.com/ylabonte/github-actions-updater/actions/runs/25931442199
inside changesets/action's `pnpm release` step.

`actions/setup-node` with `registry-url:` writes an `.npmrc` line
`//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}`. npm 11 sees a
configured token entry and skips the OIDC exchange; we don't set
NODE_AUTH_TOKEN (we want OIDC), so the resulting auth is empty and
`npm publish` 4xx's, which is what bubbled up as the pnpm exit 1.
Trusted publishing only kicks in with no token configured at all.
Default registry is the public one, so dropping `registry-url:` is
functionally a no-op for the registry pointer.

Refs:
- https://github.com/orgs/community/discussions/176761
- https://docs.npmjs.com/trusted-publishers/

Other release.yml polish items (rename `app-id` → `client-id` to silence
the v3 deprecation warning, pin pnpm/action-setup, pin `npm install -g`)
are intentionally out of scope — they are warnings, not the failure, and
client-id ≠ app-id so the rename needs a coordinated secret rotation.

Author: claude

.github/workflows/release.yml

@@ -35,11 +35,17 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
       - uses: pnpm/action-setup@v6
+      # Do NOT pass `registry-url:` to setup-node. It writes an `.npmrc` with
+      # `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}`; npm 11 then sees
+      # a token entry (empty, because we don't set NODE_AUTH_TOKEN — we want
+      # OIDC) and skips the trusted-publisher exchange, so `npm publish` 4xx's
+      # and `changeset publish` exits 1. Trusted publishing only kicks in when
+      # *no* token is configured. Default registry is registry.npmjs.org, so
+      # dropping `registry-url:` costs nothing.
       - uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: pnpm
-          registry-url: https://registry.npmjs.org
       # npm 11.5+ is required for trusted-publishing OIDC. Node 20 ships with npm 10.
       - run: npm install -g npm@latest
       - run: pnpm install --frozen-lockfile