ci: publish through npm trusted publishing

[dangreen]

Switches the release job from an npm token to OIDC, the same way TrigenSoftware/Argue#399 did - argue-cli@3.2.0 was published through it, so the path is proven with this exact action.

Three changes, and the resulting job is byte-identical to Argue's:

• id-token: write on the release job, so the runner can mint an OIDC token;
• npm-token input dropped;
• registry-url dropped from setup-node. This one is not cosmetic: with it, setup-node writes an .npmrc carrying _authToken=${NODE_AUTH_TOKEN}, and that placeholder shadows OIDC - npm sees a credential and never asks for a token.

Before merging

After this lands, the release job can only publish through a trusted publisher, and none is registered for any of the eleven packages yet - so the first release would fail with no credentials. Each package needs:

npm trust github @srcset/core --repo TrigenSoftware/srcset --file release.yml --allow-publish --yes

for @srcset/{core,runtime,bundler-utils,cli,loader,vite-plugin,react,preact,svelte,imgproxy,cloudflare}, run with npm 11.10 or newer.

Whether npm accepts the registration for a package that does not exist yet is untested. If it does, merge and release through CI. If it does not, publish once with a token first and merge this afterwards.

[coveralls]

Coverage Report for CI Build 33748218849

Coverage remained the same at 93.924%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	889
Covered Lines:	843
Line Coverage:	94.83%
Relevant Branches:	658
Covered Branches:	610
Branch Coverage:	92.71%
Branches in Coverage %:	Yes
Coverage Strength:	79446.03 hits per line

---

💛 - Coveralls