ci: use npm trusted publishing

[ehud-am]

Summary

• remove token-based npm auth from the publish workflow so npm can use GitHub OIDC trusted publishing
• switch the publish job to Node 24 to match npm's current trusted publishing guidance
• keep the existing verify gate before publish

Verification

• npm run verify
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/publish.yml"); puts "yaml-ok"'