ci: add NPM OIDC trusted publishing to release pipeline

[Copilot]

The release pipeline fails to publish because npm no longer accepts classic long-lived tokens and requires OIDC trusted publishing. This updates the release workflow to authenticate via OIDC.

Changes (.github/workflows/release.yml)

• Grant OIDC permission — added id-token: write to the release job so Actions can mint the short-lived identity token npm uses to authenticate.
• Upgrade npm — added npm install -g npm@latest before the release step; OIDC trusted publishing requires npm ≥ 11.5.1, newer than the version bundled with lts/* Node.
• Drop token auth — removed NPM_TOKEN from the Release step env, since it's obsolete under OIDC and a lingering token can conflict with OIDC auth.

permissions:
  contents: write
  pull-requests: write
  issues: write
  id-token: write # for NPM OIDC trusted publishing

The locked @semantic-release/npm@12.0.2 already supports OIDC, so no dependency changes were needed.

Follow-up (npm registry, outside this repo)

The package must be registered as a Trusted Publisher on npmjs.com (Package → Settings → Trusted Publishers) for taskforcesh/taskforce-connector with workflow release.yml. This one-time registry-side setup is required for publishes to succeed.

• Fixes ci: add support for NPM OIDC #135

[Copilot]

Pull request overview

This PR updates the release GitHub Actions workflow to publish to npm using OIDC trusted publishing (instead of long-lived npm tokens), addressing the current publish failures.

Changes:

• Granted id-token: write permission to allow minting an OIDC token for npm.
• Added a step to update npm before running semantic-release.
• Removed NPM_TOKEN from the release step environment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

🎉 This PR is included in version 1.38.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀