chore: migrate npm publishing to trusted publishing

[0xEdouardEth]

Description

Migrates NPM publishing to trusted publishing support via MetaMask/action-npm-publish@v6.

Changes:

• Updates publish workflows to use MetaMask/action-npm-publish@v6.
• Grants id-token: write permission for OIDC-based publishing.
• Makes NPM_TOKEN optional in the reusable publish workflow.
• Bumps packageManager to yarn@4.16.0 and regenerates yarn.lock.

Testing

• Validated modified workflow YAML files parse successfully.
• Ran git diff --check.

---

Note

Medium Risk
Changes how packages are authenticated and published on release; misconfiguration could block publishes or briefly rely on a manual NPM_TOKEN for the initial publish.

Overview
Switches the release pipeline to npm trusted publishing by upgrading MetaMask/action-npm-publish from v5 to v6 and enabling OIDC (id-token: write on the caller publish-release job in main.yml and on the publish-npm job). The reusable workflow now treats NPM_TOKEN as optional (was required), sets default contents: read, and documents that the token is only needed for a first-time publish before OIDC takes over.

The dry-run publish step also moves to v6 (replacing the old “omit npm-token for dry run” approach). packageManager is bumped to yarn@4.16.0 with a regenerated yarn.lock (lockfile metadata / patch checksum updates only).

^{Reviewed by Cursor Bugbot for commit f731dca. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Mrtenz]

This needs top-level permissions:

permissions:
  contents: read