ci(workflows): [publish] migrate to oidc trusted publishing

- https://docs.npmjs.com/trusted-publishers
- https://github.com/flex-development/string-wrap/actions/runs/20354912563/job/58488116279
- https://github.blog/changelog/2025-12-09-npm-classic-tokens-revoked-session-based-auth-and-cli-token-management-now-available

Signed-off-by: Lexus Drumgold <[email protected]>

Author: unicornware

.github/workflows/publish.yml

@@ -10,7 +10,7 @@
 # - https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#release
 # - https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions
 # - https://docs.github.com/webhooks-and-events/webhooks/webhook-events-and-payloads#release
-# - https://docs.npmjs.com/generating-provenance-statements
+# - https://docs.npmjs.com/trusted-publishers
 # - https://github.com/actions/checkout
 # - https://github.com/actions/setup-node
 # - https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md#yarn2-configuration
@@ -67,7 +67,7 @@ jobs:
         env:
           ARTIFACT: ${{ steps.artifact.outputs.artifact }}
           FLAGS: ${{ steps.dist.outputs.flag }}
-        run: echo "result=npm publish --provenance $FLAGS $ARTIFACT" >>$GITHUB_OUTPUT
+        run: echo "result=npm publish $FLAGS $ARTIFACT" >>$GITHUB_OUTPUT
   gpr:
     needs: preflight
     permissions:
@@ -92,7 +92,6 @@ jobs:
         name: Setup .npmrc file
         uses: actions/[email protected]
         with:
-          always-auth: true
           node-version-file: .nvmrc
           registry-url: https://npm.pkg.github.com
           scope: ${{ github.repository_owner }}
@@ -101,8 +100,6 @@ jobs:
         run: cat $NPM_CONFIG_USERCONFIG
       - id: publish
         name: Publish package
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ${{ needs.preflight.outputs.command }}
   npm:
     needs: preflight
@@ -131,7 +128,6 @@ jobs:
         name: Setup .npmrc file
         uses: actions/[email protected]
         with:
-          always-auth: true
           node-version-file: .nvmrc
           registry-url: https://registry.npmjs.org
           scope: ${{ github.repository_owner }}
@@ -140,6 +136,4 @@ jobs:
         run: cat $NPM_CONFIG_USERCONFIG
       - id: publish
         name: Publish package
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: ${{ needs.preflight.outputs.command }}