ci: publish through npm trusted publishing

[dangreen]

Moves publishing from a long-lived NPM_TOKEN to npm OIDC trusted publishing.

• The release job gets permissions: id-token: write — without a permissions block GitHub issues no OIDC token — plus contents: write, which the action needs for the tag and the GitHub release.
• npm-token is no longer passed to simple-release-action. Publishing goes through @simple-release/pnpm, and pnpm performs the token exchange itself since 10.9; this workflow installs 11.
• registry-url is dropped from actions/setup-node. It writes a placeholder _authToken line into .npmrc, and that would shadow the exchange.

There is no snapshot workflow here, so the "one trusted publisher per package" limit needs no workarounds.

Before this can publish

The trusted publisher has to exist on the npm side, pointing at this workflow file:

npx -y npm@latest trust github argue-cli \
  --repo TrigenSoftware/Argue --file release.yml --allow-publish --yes

Afterwards the NPM_TOKEN repository secret is unused and can be deleted.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.47%. Comparing base (0594f8a) to head (0ec1f91).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #399      +/-   ##
==========================================
+ Coverage   98.34%   98.47%   +0.12%     
==========================================
  Files           5        5              
  Lines         121      131      +10     
  Branches       31       35       +4     
==========================================
+ Hits          119      129      +10     
  Misses          2        2              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.