ci(release): publish through npm trusted publishing (OIDC) (tester-ar…

…my#707)

Drops NPM_TOKEN from release.yml; each package grants release.yml publish
rights via an npm trusted publisher. Release job moves to ubuntu-latest
because npm rejects OIDC from self-hosted runners (Blacksmith included).
publishConfig.provenance pins removed so provenance attaches automatically
once the repo is public. Setup recipe documented in CONTRIBUTING.md.

ci(release): publish through npm trusted publishing (OIDC) (tester-ar…

…my#707)

Drops NPM_TOKEN from release.yml; each package grants release.yml publish
rights via an npm trusted publisher. Release job moves to ubuntu-latest
because npm rejects OIDC from self-hosted runners (Blacksmith included).
publishConfig.provenance pins removed so provenance attaches automatically
once the repo is public. Setup recipe documented in CONTRIBUTING.md.

ci(release): publish through npm trusted publishing (OIDC) (tester-ar…

…my#707)

Drops NPM_TOKEN from release.yml; each package grants release.yml publish
rights via an npm trusted publisher. Release job moves to ubuntu-latest
because npm rejects OIDC from self-hosted runners (Blacksmith included).
publishConfig.provenance pins removed so provenance attaches automatically
once the repo is public. Setup recipe documented in CONTRIBUTING.md.

ci(release): publish through npm trusted publishing (OIDC) (tester-ar…

…my#707)

Drops NPM_TOKEN from release.yml; each package grants release.yml publish
rights via an npm trusted publisher. Release job moves to ubuntu-latest
because npm rejects OIDC from self-hosted runners (Blacksmith included).
publishConfig.provenance pins removed so provenance attaches automatically
once the repo is public. Setup recipe documented in CONTRIBUTING.md.

ci(release): publish through npm trusted publishing (OIDC) (tester-ar…

…my#707)

Drops NPM_TOKEN from release.yml; each package grants release.yml publish
rights via an npm trusted publisher. Release job moves to ubuntu-latest
because npm rejects OIDC from self-hosted runners (Blacksmith included).
publishConfig.provenance pins removed so provenance attaches automatically
once the repo is public. Setup recipe documented in CONTRIBUTING.md.

ci(release): publish through npm trusted publishing (OIDC) (tester-ar…

…my#707)

Drops NPM_TOKEN from release.yml; each package grants release.yml publish
rights via an npm trusted publisher. Release job moves to ubuntu-latest
because npm rejects OIDC from self-hosted runners (Blacksmith included).
publishConfig.provenance pins removed so provenance attaches automatically
once the repo is public. Setup recipe documented in CONTRIBUTING.md.