ci: switch npm publish to OIDC trusted publishing

This repo's release.yml authenticated npm publish via NODE_AUTH_TOKEN wired to the
NPM_TOKEN secret. That pattern failed in prod on 2026-06-02 when
@mcptoolshop/backprop-trace's NPM_TOKEN expired (npm masks an expired token as E404,
not 403). Switch to npm Trusted Publishing (OIDC), matching the proven backprop-trace
fix: remove NODE_AUTH_TOKEN/NPM_TOKEN from the publish step; add npm install -g
npm@latest (OIDC needs npm >= 11.5.1; Node 22 ships 10.9.x); keep id-token: write and
npm publish --provenance --access public.

Inert until a Trusted Publisher is configured on npmjs.com for @mcptoolshop/ai-loadout bound to
ai-loadout / release.yml. The NPM_TOKEN secret is intentionally retained as a revert
path until the first OIDC release is confirmed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mcp-tool-shop

.github/workflows/release.yml

@@ -2,7 +2,7 @@ name: Release
 
 # Fires on git tags shaped like v1.0.0, v1.0.1, v1.1.0, etc.
 # - Builds + verifies (tests).
-# - Publishes to npm with --provenance (uses NPM_TOKEN secret).
+# - Publishes to npm with --provenance via npm Trusted Publishing (OIDC).
 # - Creates a GitHub Release with auto-generated notes.
 
 on:
@@ -62,10 +62,14 @@ jobs:
           fi
           echo "CLI version smoke: $BUILT_VERSION"
 
+      # OIDC trusted publishing requires npm >= 11.5.1; Node 20 bundles
+      # npm 10.x, so upgrade the global npm before the publish call.
+      - name: Upgrade npm for OIDC trusted publishing (>= 11.5.1)
+        run: npm install -g npm@latest
+
       - name: Publish to npm (with provenance)
+        # Auth via npm Trusted Publishing (OIDC) - intentionally NO NODE_AUTH_TOKEN.
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create GitHub Release
         env: