fix: publish npm package with trusted publishing

[cjbell]

Description

Migrate the npm release job from a long-lived NPM_TOKEN to npm trusted publishing via GitHub Actions OIDC.

• grant the publish job id-token: write and read-only repository contents
• update all release jobs to current checkout and setup-node actions
• install the latest npm 11 release before publishing so the CLI supports trusted publishing while retaining the package's npm shrinkwrap prepack lifecycle (removed in npm 12)
• publish the public scoped package with npm instead of Yarn and remove NPM_TOKEN

The @knocklabs/cli package must have this repository and .github/workflows/on-release-created.yml registered as a trusted publisher in npm before the next release.

Validation

• yarn run check
• actionlint .github/workflows/on-release-created.yml
• npx --yes npm@11 publish --dry-run --access public

Tasks

KNO-14497

Linear Issue: KNO-14497

  

[linear-code]

KNO-14497

[cjbell]

Merge activity

• Jul 28, 10:45 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 28, 10:45 PM UTC: @cjbell merged this pull request with Graphite.