fix(release): enable npm trusted publishing in release workflow

[Copilot]

The release Actions job failed during semantic-release publish with npm E403 because the workflow was not configured for OIDC trusted publishing and fell back to token-based auth. This change aligns the workflow with npm trusted publisher requirements.

• Root cause addressed

  • Add workflow permission required for GitHub OIDC token issuance:
    • id-token: write

• Publish auth path corrected

  • Remove token-based npm env vars from the release step:
    • NPM_TOKEN
    • NODE_AUTH_TOKEN
  • This ensures @semantic-release/npm uses OIDC trusted publishing instead of invalid/insufficient token credentials.

• Workflow diff (core change)

permissions:
  contents: write
  issues: write
  id-token: write
  pull-requests: write

# release step env now only keeps:
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}