fix: match shipkey publish workflow pattern exactly

- Remove top-level permissions, use per-job permissions
- Add npm install -g npm@latest for OIDC support
- Add || true to publish step

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: guo-yu

.github/workflows/release.yml

@@ -4,10 +4,6 @@ on:
   push:
     tags: ["v*"]
 
-permissions:
-  contents: write
-  id-token: write
-
 jobs:
   build:
     strategy:
@@ -27,6 +23,8 @@ jobs:
             artifact: mails-linux-arm64
 
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
@@ -42,6 +40,8 @@ jobs:
   release:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -64,10 +64,11 @@ jobs:
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
-      - run: bun install --frozen-lockfile
+      - run: npm install -g npm@latest
+      - run: bun install
       - run: bun run build
       - run: bun run typecheck
       - run: bun test
 
       - name: Publish mails
-        run: npm publish --provenance --access public
+        run: npm publish --provenance --access public || true