ci(release): publish to npm through OIDC trusted publishing only (#54)

Drop the actions/setup-node step from the publish job. It only wrote an
.npmrc that reads NODE_AUTH_TOKEN, which nothing sets, so npm saw a
placeholder token next to the OIDC exchange. npm now authenticates with
id-token: write and each package's trusted publisher alone, and a package
without one fails instead of falling back to a token.

Author: amondnet

.github/workflows/release-please.yml

@@ -109,13 +109,12 @@ jobs:
       - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
 
       # npm CLI is the publisher: bun publish supports neither npm OIDC
-      # trusted publishing nor --provenance (oven-sh/bun#22423). setup-node
-      # only provisions the registry .npmrc here (no node-version: it uses the
-      # mise-installed node on PATH); id-token: write + a trusted publisher
-      # configured on npmjs.com let npm authenticate tokenlessly via OIDC.
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          registry-url: https://registry.npmjs.org
+      # trusted publishing nor --provenance (oven-sh/bun#22423). Publishing
+      # authenticates through OIDC only: id-token: write plus a trusted
+      # publisher configured on npmjs.com for each package. No .npmrc auth
+      # token is provisioned (no setup-node registry-url / NODE_AUTH_TOKEN), so
+      # a package without a trusted publisher fails to publish rather than
+      # falling back to a token.
 
       # OIDC trusted publishing requires npm >= 11.5.1; pin to the latest 11.x
       # in case the runner's bundled npm predates it.