ci: fix Yarn install with npm OIDC

[Aidosmf]

Summary

• stop setup-node from generating an npm auth placeholder that Yarn 1 cannot resolve in tokenless OIDC workflows
• retain npm trusted publishing; npm uses its default registry
• document why registry-url must stay absent

Context

Dependabot PR #23 upgraded setup-node to v7, which removed its dummy NODE_AUTH_TOKEN export. The subsequent release run failed during the frozen Yarn install:

• Failed Release action
• setup-node upgrade PR #23

When registry-url is set, setup-node writes ${NODE_AUTH_TOKEN} into its generated npm configuration. Yarn 1 treats the missing environment variable as fatal. npm already defaults to registry.npmjs.org, and changesets/action detects OIDC independently.

Version 1.3.0 is already published; this change only restores future release runs.

Validation

• git diff --check
• yarn prettier --check .github/workflows/release.yml
• yarn install --frozen-lockfile
• yarn test

No changeset is included because this only changes CI configuration.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7de8e6e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[kudanai]

Verified the mechanism: id-token: write is still present so OIDC publishing is unaffected — it auto-detects from the CI environment + id-token permission and doesn't need registry-url. publishConfig has no registry override, so npm publish defaults to registry.npmjs.org on its own. Dropping registry-url removes the //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN} line that setup-node writes into .npmrc, which is exactly what Yarn 1's frozen install was choking on. setup-node SHA confirmed as v7.0.0, and no changeset is correct for a CI-only change. The inline comment explaining why the line must stay absent is the right call. LGTM 🚀