ci: use npm trusted publishing - #31

Summary

Authenticate npm releases through GitHub Actions OIDC instead of the expiring long-lived NPM_TOKEN secret.

• Remove NODE_AUTH_TOKEN from the publish step so npm uses the workflow OIDC identity.
• Disable package-manager caching for audited release builds, following npm Trusted Publishing guidance.
• Keep the existing GitHub-hosted runner, Node 24, npm registry URL, provenance, and id-token: write permission.

Before the next GitHub release is published, configure the wingdiff package trusted publisher on npm for HartBrook/wingdiff and workflow filename publish-npm.yml, with direct npm publish allowed.

Verification

• git diff --check
• Parsed .github/workflows/publish-npm.yml with Ruby YAML
• Confirmed no NPM_TOKEN or NODE_AUTH_TOKEN references remain

Runtime tests are unnecessary because this changes only release-workflow authentication and caching inputs; GitHub Actions validates the workflow after push.

Risk and privacy

Publishing will require the matching npm Trusted Publisher configuration. Once configured, releases use short-lived workflow-specific credentials instead of a stored npm write token. No application runtime, source handling, provider, persistence, or code-host write behavior changes.

Checklist

• The change is focused and documented.
• Tests are unnecessary for this workflow-only change; validation is listed above.
• Application build and test behavior is unchanged.
• Screenshots are not applicable.
• I did not commit credentials, private source, or local Wingdiff data.