Require OIDC for npm publication

[raghubetina]

Summary

• remove NODE_AUTH_TOKEN and the persistent npm secret path from the publication job
• require the exact GitHub-hosted runner, protected npm environment, OIDC permission, Node/npm toolchain, and single next publish command
• reject any Actions secret or authentication-token reference in the release workflow
• verify the release toolchain on every pull request before a protected release tag can be created
• document exact npm trust-list identity, secret-free recovery, and unpublished-candidate immutability boundaries
• preserve @firstdraft.com/cli@0.1.0, API contract 0.2, progress behavior, the next publication channel, and the unchanged latest tag

Verification

• exact Node v24.18.0 and npm 11.16.0 checks
• npm ci --ignore-scripts
• npm audit (0 vulnerabilities)
• npm run check (typecheck, lint, format, 150 tests, pack check, packed executable smoke)

Release boundary

The protected release workflow now authenticates to npm only through its exact trusted-publisher relationship and a short-lived GitHub OIDC credential. Package-level token disallow remains optional defense-in-depth and is not claimed here. This pull request does not merge, create a release tag, publish npm, move latest, or deploy anything.