fix: use OIDC trusted publishing instead of NPM_TOKEN

[vorflux]

Summary

The publish workflow was failing with ENEEDAUTH because NPM_TOKEN secret is not configured in this repo. Instead of adding a token, this switches to npm OIDC trusted publishing which authenticates via GitHub Actions' built-in OIDC identity -- no secrets needed.

Root Cause

actions/setup-node with registry-url creates an .npmrc containing ${NODE_AUTH_TOKEN}. When NPM_TOKEN isn't set in the repo secrets, that variable resolves to an empty string. npm then attempts token-based auth with the empty string and fails with ENEEDAUTH instead of falling through to OIDC.

Changes

• Removed NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} -- not needed with OIDC
• Removed registry-url from actions/setup-node -- prevents .npmrc from being generated with an empty token placeholder that blocks OIDC fallback
• Removed NPM_CONFIG_PROVENANCE env var -- replaced with --provenance flag directly on the publish command
• Added node-version: '24' -- npm CLI 11.5.1+ is required for OIDC trusted publishing
• The id-token: write permission was already set, which is what OIDC needs

Prerequisite

The package code-chunk must have a trusted publisher configured on npmjs.com pointing to:

• Repository: supermemoryai/code-chunk
• Workflow: release.yml

See npm trusted publishing docs for setup.

Testing

• YAML syntax validated
• Reviewed failed run logs (run 24543674622) confirming ENEEDAUTH due to empty NODE_AUTH_TOKEN
• Verified the fix removes both the token dependency and the registry-url that generates the problematic .npmrc

---

Session Details

• Session: View Session
• Requested by: Unknown
• Address comments on this PR. Add (aside) to your comment to have me ignore it.