Use npm OIDC trusted publishing in release workflow (#759)

* Initial plan

* Update release workflow to use npm OIDC trusted publishing

Co-authored-by: quantizor <[email protected]>

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: quantizor <[email protected]>

Author: Copilot

.github/workflows/release.yml

@@ -10,6 +10,10 @@ concurrency: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -29,7 +33,6 @@ jobs:
         uses: changesets/action@v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         with:
           createGithubReleases: true
           publish: bun run changeset-publish