Use npm trusted publishing with OIDC for package releases

- Add id-token: write and contents: read permissions for OIDC
- Update to npx npm@11.7.0 publish with --provenance flag
- Update actions to v6

Author: hillna

.github/workflows/ci.yml

@@ -34,4 +34,4 @@ jobs:
       - run: yarn pack
       - name: Publish to NPM
         if: ${{ startsWith(github.ref, 'refs/tags/v') }}
-        run: npx npm@latest publish package.tgz --provenance --access public
+        run: npx npm@11.7.0 publish package.tgz --provenance --access public

package.json

@@ -52,5 +52,5 @@
     "typescript": "5.9.3",
     "typescript-eslint": "8.13.0"
   },
-  "packageManager": "yarn@4.5.1"
+  "packageManager": "yarn@4.12.0"
 }

yarn.lock

@@ -5532,11 +5532,11 @@ __metadata:
 
 "typescript@patch:typescript@npm%3A5.9.3#optional!builtin<compat/typescript>":
   version: 5.9.3
-  resolution: "typescript@patch:typescript@npm%3A5.9.3#optional!builtin<compat/typescript>::version=5.9.3&hash=cef18b"
+  resolution: "typescript@patch:typescript@npm%3A5.9.3#optional!builtin<compat/typescript>::version=5.9.3&hash=5786d5"
   bin:
     tsc: bin/tsc
     tsserver: bin/tsserver
-  checksum: 10c0/6f7e53bf0d9702350deeb6f35e08b69cbc8b958c33e0ec77bdc0ad6a6c8e280f3959dcbfde6f5b0848bece57810696489deaaa53d75de3578ff255d168c1efbd
+  checksum: 10c0/ad09fdf7a756814dce65bc60c1657b40d44451346858eea230e10f2e95a289d9183b6e32e5c11e95acc0ccc214b4f36289dcad4bf1886b0adb84d711d336a430
   languageName: node
   linkType: hard