🛠️ Repo: use OIDC for publishing

[mark-wiemer]

Tooling Suggestion Checklist

• I have tried restarting my IDE and the issue persists.
• I have pulled the latest main branch of the repository.
• I have read and agree to Mocha's Code of Conduct and Contributing Guidelines
• I have searched for related issues and issues with the faq label, but none matched my issue.
• I want to provide a PR to resolve this

Overview

It's a more secure way because we don't need long-lived npm tokens :)

Additional Info

No response

[mark-wiemer]

Release of beta 4 via OIDC failed:

...
npm notice total files: 71
npm notice
npm notice Publishing to https://registry.npmjs.org/ with tag next and public access
npm notice Access token expired or revoked. Please try logging in again.
npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/mocha - Not found
npm error 404
npm error 404  'mocha@12.0.0-beta-4' is not in this registry.
npm error 404
npm error 404 Note that you can also install from a
npm error 404 tarball, folder, http url, or git url.
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2026-01-04T21_57_17_972Z-debug-0.log
Error: Process completed with exit code 1.
[end of logs]

Compare with successful release of beta 3:

...
npm notice total files: 71
npm notice
npm notice Publishing to https://registry.npmjs.org/ with tag next and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=787219604
+ mocha@12.0.0-beta-3
[end of logs]