Use trusted publishing for npm releases

[uchebnick]

Summary

• switch npm release publishing from NPM_TOKEN to npm Trusted Publishing/OIDC
• grant the release workflow id-token permission
• use Node 24 so npm has Trusted Publishing support

Notes

• npm must be configured with a Trusted Publisher for package @uchebnick/unch:
  • owner: uchebnick
  • repository: unch
  • workflow filename: release.yml

Tests

• git diff --check