Use npm trusted publishing

Author: Ameyanagi

.github/workflows/release.yml

@@ -80,6 +80,7 @@ jobs:
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
+          package-manager-cache: false
       - run: npm install -g npm@latest
       - run: bun install --frozen-lockfile
         working-directory: bindings/wasm
@@ -89,9 +90,6 @@ jobs:
         working-directory: bindings/wasm
       - run: npm publish ./pkg --access public
         working-directory: bindings/wasm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: "true"
 
   python-build:
     name: Build Python wheels

docs/bindings.md

@@ -56,15 +56,15 @@ Releases are driven by Git tags like `v0.2.0`.
 
 Before the first automated release:
 
-- Configure npm publishing for `@ameyanagi/chemical-formula`.
+- Configure npm trusted publishing for `@ameyanagi/chemical-formula`.
   - Workflow: `release.yml`
   - Environment: `npm`
-  - Secret: `NPM_TOKEN`
+  - Allowed action: `npm publish`
 - Configure PyPI trusted publishing for `chemical-formula-rs`.
   - Workflow: `release.yml`
   - Environment: `pypi`
 
-The release workflow publishes npm with provenance and an `NPM_TOKEN` environment secret. PyPI publishing uses OIDC trusted publishing.
+The release workflow publishes npm and PyPI through OIDC trusted publishing. It does not require long-lived registry tokens.
 
 ## Public Binding API