fix: strip _authToken from .npmrc for OIDC trusted publishing

setup-node with registry-url creates .npmrc with _authToken placeholder
that prevents npm from using OIDC authentication. Delete the auth token
entry before publish so npm falls through to the OIDC flow.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: nam-hle

.github/workflows/release.yml

@@ -35,9 +35,17 @@ jobs:
       - name: Build
         run: nadle build
 
+      - name: Setup npm for trusted publishing
+        if: ${{ !startsWith(github.ref_name, 'vscode-extension/') }}
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          registry-url: https://registry.npmjs.org
+
       - name: Publish to npm
         if: ${{ !startsWith(github.ref_name, 'vscode-extension/') }}
-        run: npm publish --provenance --access public
+        run: |
+          npm config delete //registry.npmjs.org/:_authToken
+          npm publish --provenance --access public
         working-directory: packages/${{ steps.parse-tag.outputs.package }}
 
       - name: Publish VS Code Extension