ci: switch npm publish to Trusted Publishing (OIDC)

Replace token-based JS-DevTools/npm-publish@v1 with native
`npm publish --provenance` using GitHub OIDC. Bumps Node to 22.x
and upgrades npm to satisfy the >=11.5.1 requirement for trusted
publishing, and grants `id-token: write` so the job can mint
the OIDC token npm exchanges for publish credentials.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: zhengyangliu

.github/workflows/publish-npm-package.yml

@@ -8,17 +8,22 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '16.x'
+          node-version: '22.x'
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Upgrade npm for Trusted Publishing
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: npm ci
 
-      - uses: JS-DevTools/npm-publish@v1
-        with:
-          token: ${{ secrets.NPM_TOKEN }}
+      - name: Publish to npm
+        run: npm publish --provenance --access public