chore(ci): switch npm publish to Trusted Publishing (OIDC)

Replaces NPM_TOKEN-based auth with npm Trusted Publishing. GitHub
Actions exchanges its OIDC identity for a short-lived npm publish token
at publish time — no long-lived secret in the repo, nothing to rotate.

Changes:
- publish.yml: drop NODE_AUTH_TOKEN env. Add `npm install -g npm@latest`
  step (Trusted Publishing requires npm >= 11.5.1; Node 20 ships 10.x).
- id-token: write permission already in place from the previous
  provenance commit (17f8384); same permission serves both purposes.

One-time manual setup on the npm side:
  https://www.npmjs.com/package/@tindalabs/shield/access
  → "Add trusted publisher" → GitHub Actions
  → org: tindalabs, repo: shield, workflow: publish.yml

After that, the four existing Publish tokens (id 778104, 0185f2,
256433, ecc691) can be revoked and the NPM_TOKEN GitHub secret deleted.

Author: Isonimus

.github/workflows/publish.yml

@@ -12,10 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      # id-token: write is required for npm provenance. The OIDC token from
-      # GitHub Actions is exchanged for an attestation that links the published
-      # tarball to this exact workflow run + commit SHA — closes the
-      # compromised-NPM-token → malicious-patch supply-chain scenario.
+      # id-token: write is required for BOTH npm Trusted Publishing (OIDC auth
+      # to npm — no NPM_TOKEN secret needed) AND npm provenance attestation
+      # (signed link between this workflow run + commit SHA → published tarball).
       id-token: write
     steps:
       - name: Checkout code
@@ -27,6 +26,10 @@ jobs:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
 
+      # Trusted Publishing requires npm >= 11.5.1; Node 20 ships with npm 10.x.
+      - name: Upgrade npm for Trusted Publishing
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: npm ci
 
@@ -39,7 +42,9 @@ jobs:
       - name: Build
         run: npm run build
 
+      # No NODE_AUTH_TOKEN needed — Trusted Publishing exchanges the GitHub
+      # OIDC token for a short-lived npm publish token at publish time. The
+      # `--provenance` flag is implied under Trusted Publishing but kept
+      # explicit for readability.
       - name: Publish to npm
         run: npm publish --access public --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

ROADMAP.md

@@ -219,7 +219,7 @@ The cross-cutting finding: the product is built, distribution is the bottleneck,
 ### Immediate (this week)
 
 - [x] ~~**Verify v0.1.0 is live on npm.**~~ ✅ Confirmed: `npm view @tindalabs/shield version` returns `0.1.0`; tarball resolves at `registry.npmjs.org/@tindalabs/shield/-/shield-0.1.0.tgz`.
-- [~] **Enable npm publish provenance + 2FA on the publishing account.** `--provenance` flag + `id-token: write` permission added to `publish.yml`; next `v*` tag push will produce a signed attestation visible on npmjs.com. **Manual follow-up:** enable `auth-and-writes` 2FA on the publishing account at https://www.npmjs.com/settings/~/profile (account-level; not automatable via PR).
+- [x] ~~**Enable npm publish provenance + 2FA on the publishing account.**~~ ✅ Three layers shipped: (1) `auth-and-writes` 2FA enabled on the `isonimus` npm account (manual). (2) `--provenance` flag + `id-token: write` in `publish.yml` → signed attestation linking tarball to workflow run + commit SHA. (3) **Trusted Publishing (OIDC)** wired in `publish.yml` — no `NPM_TOKEN` secret needed; GitHub's OIDC token is exchanged at publish time for a short-lived npm token. Manual one-time setup: add GitHub Actions as a trusted publisher in https://www.npmjs.com/package/@tindalabs/shield/access (org=`tindalabs`, repo=`shield`, workflow=`publish.yml`).
 - [x] ~~**Cut a real `[0.1.0]` CHANGELOG section.**~~ ✅ Done in commit `d447a04` — `[Unreleased]` rotated into `[0.1.0] - 2026-05-29` capturing `assess()`, `attachShieldToSpan()`, `assessAndProtect()`, `ContentProtector`, `ClipboardStrategy` integration, CI/publish workflows, and the jest-environment-jsdom dependency relocation.
 - [x] ~~**Add CodeQL workflow**~~ ✅ Added at `.github/workflows/codeql.yml` — runs `javascript-typescript` analysis with the `security-and-quality` query pack on every push to `main`, every PR, and weekly on Monday 06:00 UTC. Findings surface in the repo's Security tab.
 - [x] ~~**Add a 30-second "which API do I want?" decision tree**~~ ✅ Added as a new `## Which API do I want?` section between Install and Quick Start. Three-row table maps user goal (observe / block / both) to the right API (`assess()` / `ContentProtector` / `assessAndProtect()`) with one-line "what it does" descriptions, plus a pointer to `attachShieldToSpan()` for OTel-instrumented wrapping.