Fix npm publish: remove auth token so OIDC trusted publishing works

actions/setup-node injects an empty NODE_AUTH_TOKEN into .npmrc,
which prevents npm from falling back to the OIDC token exchange.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lu-zhengda

.github/workflows/publish.yml

@@ -22,4 +22,5 @@ jobs:
       - run: npm run build
       - run: npm run lint
       - run: npm run test:unit
+      - run: npm config delete //registry.npmjs.org/:_authToken || true
       - run: npm publish --provenance --access public