[CI/CD] switch npm publishing to trusted publishing (OIDC)

[iamalwaysuncomfortable]

Motivation

Final step of the trusted-publishing migration (#26, #27): npm publishing no longer uses a registry token. The job mints a GitHub OIDC token that npm verifies against each package's trusted publisher config (org ProvableHQ, repo aleo-devnode, workflow npm-publish.yml — already configured on all six packages), exchanges it for a short-lived per-publish credential, and generates provenance attestations automatically.

Changes to npm-publish.yml:

• permissions: id-token: write (plus contents: read for the tag guard and release-asset download).
• registry-url removed from setup-node: it writes an .npmrc authToken line referencing $NODE_AUTH_TOKEN, and npm hard-fails on every command when a referenced env var is unset — with the token gone, keeping it would break the workflow outright.
• Node 24 (Node 20 is EOL) and npm@12.0.1 pinned alongside the existing semver pin: trusted publishing requires npm ≥ 11.5.1 and the runner's bundled npm may lag. Exact pins for the same supply-chain reason as consolidate npm publishing for trusted publishing (OIDC) #26's semver pin.
• NODE_AUTH_TOKEN removed from the publish step. No token is referenced anywhere in the workflows anymore.

The six packages already disallow token publishing (npmjs.com publishing-access setting), so after this merges the NPM_TOKEN repo secret is dead weight: the remaining cleanup is revoking the granular token on npmjs.com and deleting the secret.

Rollback path if the first OIDC publish fails: revert this PR, re-enable token publishing on the packages, and restore a valid NPM_TOKEN.

Test Plan

• YAML validation passes; no functional NPM_TOKEN/NODE_AUTH_TOKEN/registry-url references remain in either workflow.
• Real verification is the next release: the publish run should show npm exchanging the OIDC token and provenance attestations on the six package pages ("built and signed on GitHub Actions").

Related PRs

• consolidate npm publishing for trusted publishing (OIDC) #26 (publish flow consolidation for trusted publishing)
• fix npm publish path spec: bare dist-npm/<name> parses as GitHub shorthand #27 (path-spec fix surfaced by the bootstrap publish)