ci(release): harden JSR publish step (OIDC, fail-loud)

- Drop continue-on-error so JSR publish failures fail the release
  instead of silently skipping. OIDC is already set up (id-token: write
  permission at the top of the workflow), so auth is handled
  automatically — no token secret needed.
- Switch to `npx jsr publish`, the form recommended by JSR's Publishing
  from CI docs. Behavior matches `pnpm dlx jsr publish` but sidesteps
  any npm-registry auth interaction with the pnpm wrapper during the
  OIDC handshake.
- `--allow-slow-types` retained as a safety net for JSR's slow-type
  analyzer in generic-heavy spots.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: productdevbook

.github/workflows/release.yml

@@ -51,9 +51,8 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-      - name: 🦕 Publish to JSR
-        run: pnpm dlx jsr publish --allow-slow-types
-        continue-on-error: true
+      - name: 🦕 Publish to JSR (OIDC)
+        run: npx jsr publish --allow-slow-types
 
       - name: 📝 Generate changelog
         run: pnpm dlx changelogithub