fix: upgrade npm to latest for OIDC trusted publishing

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: glommer

.github/workflows/publish.yml

@@ -4,6 +4,10 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -17,7 +21,9 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-          registry-url: https://registry.npmjs.org
+
+      - name: Upgrade npm for OIDC support
+        run: npm install -g npm@latest
 
       - run: bun install
 
@@ -28,6 +34,4 @@ jobs:
         run: bun test/smoke.ts
 
       - name: Publish
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --provenance --access public