fix(ci): use OIDC trusted publishing — drop NPM_TOKEN secret dependency