fix: trusted publishing — remove registry-url that blocked OIDC

setup-node with registry-url creates an .npmrc that overrides OIDC
auto-detection, causing ENEEDAUTH. Removed it so npm CLI can use
the GitHub OIDC token directly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: glommer

.github/workflows/publish.yml

@@ -4,12 +4,13 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -19,8 +20,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
-          registry-url: https://registry.npmjs.org
+          node-version: 22
 
       - run: bun install
 
@@ -32,5 +32,3 @@ jobs:
 
       - name: Publish
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}