Note npm trusted publishing in README

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: cmdcolin

README.md

@@ -9,6 +9,8 @@ Read Tabix-indexed files using either .tbi or .csi indexes.
 
     $ npm install @gmod/tabix
 
+Releases are published to npm automatically via GitHub Actions using [npm trusted publishing](https://docs.npmjs.com/generating-provenance-statements) (OIDC provenance) when a `v*` tag is pushed.
+
 ## Usage
 
 ### Importing the module