feat: trusted publishers

[v1v]

What

• Bump checkout and nodejs actions
• Use package.json with the provenance by default
• Remove exec plugin added ci: use semantic-release for releases #829 no more TOTP is needed
• Remove adhoc configuration with NPM_TOKEN
• See https://docs.npmjs.com/trusted-publishers
• ensure support for OIDC with the official registry semantic-release/npm#958

Why

Tidy up and use OIDC, improve our security posture by following the best practices

Further details

That's already done in some other projects:

• release @elastic/[email protected]; switch to trusted publishing elastic-otel-node#1063
• release 4.14.0; switch to trusted publishing apm-agent-nodejs#4794

Tasks

• Configure trusted publisher

Test

Renamed the package: feature/trusted-publisher...v1v:synthetics:test/feature/trusted-publisher

npmjs package -> https://www.npmjs.com/package/test-2fa/

Tests

• Dry Run in my fork -> https://github.com/v1v/synthetics/actions/runs/18558181411/job/52900599043
• Tag -> https://github.com/v1v/synthetics/actions/runs/18558247597 - failed because ensure support for OIDC with the official registry semantic-release/npm#958