fix(ci): use OIDC npm publish config in workflow (#19)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: Copilot

.github/workflows/publish.yml

@@ -6,22 +6,24 @@ on:
       - '[0-9]*.[0-9]*.[0-9]*'
 
 permissions:
-  contents: write
-  id-token: write  # npm OIDC Trusted Publishing + provenance
+  id-token: write
+  contents: read
 
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: pnpm/action-setup@v4
         with:
           version: 10.14.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
 
       - name: Install dependencies
         run: pnpm install --prefer-frozen-lockfile