Drops NPM_TOKEN from release.yml; each package grants release.yml publish
rights via an npm trusted publisher. Release job moves to ubuntu-latest
because npm rejects OIDC from self-hosted runners (Blacksmith included).
publishConfig.provenance pins removed so provenance attaches automatically
once the repo is public. Setup recipe documented in CONTRIBUTING.md.