ci: publish to npm via trusted publishing (OIDC) instead of token

[nicosampler]

Summary

No related issue. The first release run failed with EOTP: token-based publish requires a 2FA-bypassing token, and the configured one didn't qualify.

Switch release.yml to npm trusted publishing (OIDC). The trusted publisher for this repo/workflow is already configured on npmjs.com for @bootnodedev/cbn, so no npm token is involved at all and provenance is attached automatically.

Changes

• Upgrade npm on the runner before publishing (trusted publishing requires npm >= 11.5.1; node 22 ships npm 10)
• Drop registry-url from setup-node and the NODE_AUTH_TOKEN env — token auth is no longer used
• Drop NPM_CONFIG_PROVENANCE — provenance is automatic with trusted publishing
• Add an empty changeset for this PR (CI-only change)

Acceptance criteria

• The Release workflow publishes @bootnodedev/cbn@0.1.2 to npm on the next push to main, without NPM_TOKEN
• The published version carries a provenance attestation

Test plan

Automated tests

No automated tests added.

Manual verification

• Merge this PR: version 0.1.2 is still unpublished, so the Release run on main retries the publish via OIDC
• Confirm with npm view @bootnodedev/cbn version and the provenance badge on npmjs.com
• Afterwards, the NPM_TOKEN repo secret can be deleted

Breaking changes

None.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.