Switch npm publish to trusted publishing

Removes the long-lived NPM_MCP_WRITE token in favour of OIDC-based
trusted publishing. GitHub's id-token vouches for the workflow run and
npm exchanges that for a short-lived publish token, so there is no
shared secret to rotate.

- Bumps Node from 22 to 24 in both workflows. Node 24 is the active LTS
  and ships with npm 11, which is required for trusted publishing.
  Bumping CI alongside release keeps the build environments aligned, so
  Node-24-specific failures surface in CI rather than at release time.
- Drops NODE_AUTH_TOKEN from the publish step. The id-token: write
  permission is already set for provenance and MCP Registry OIDC.

The trusted publisher must be configured on npmjs.com for
@professional-wiki/mediawiki-mcp-server with this repository and
release.yml as the source.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: alistair3149

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
 
     - uses: actions/setup-node@v6
       with:
-        node-version: 22
+        node-version: 24
         cache: 'npm'
 
     - name: Run preflight checks

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '22'
+          node-version: '24'
           registry-url: 'https://registry.npmjs.org/'
 
       - name: Run preversion checks
@@ -32,8 +32,6 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_MCP_WRITE }}
 
       - name: Update server.json (npm)
         run: node scripts/update-server-json-npm.cjs