Use npm trusted publishing

[roodboi]

What changed

• grant the publish job the OIDC permission required by npm trusted publishing
• remove the long-lived NPM_TOKEN from the workflow
• extend the workflow security test to require OIDC and reject npm secrets

Why

The 4.1.0 release reached npm but failed because the standalone repository was still using a token that cannot publish schema-stream. Island AI already publishes this package through npm's repository-bound trusted publisher; the standalone workflow should use the same short-lived credential model.

The npm trusted-publisher binding must target hack-dance/schema-stream, publish.yml, and the PUBLISH environment.

Validation

• bun run format
• bun run lint
• bun test tests/workflow-security.test.ts
• bun run type-check
• git diff --check