docs(release): document npm Trusted Publishing prerequisites

[Yan Xue (yanxue06)]

Cuts the first OIDC-published release of @photon-ai/cli now that both gates are in place:

1. npmjs trusted publisher configured for @photon-ai/cli → GitHub org photon-hq, repo cli, caller workflow release.yaml, no environment, Allow npm publish.
2. buildspace publish-npm now upgrades npm to ≥ 11.5.1 (buildspace#80) — Node 20 ships npm 10, which signs provenance but can't authenticate tokenlessly (the prior E404s).

This PR also documents those prerequisites in release.yaml so it's reproducible. Carries the release label; on merge, buildspace's label gate cuts 0.3.3 and publishes it via OIDC (no NPM_TOKEN).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Chores
  • Updated release workflow documentation to include deployment configuration prerequisites for future maintainers.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5f4eb77e-9f4f-4a27-8a44-080708dbbc34

📥 Commits

Reviewing files that changed from the base of the PR and between f7bbd15 and 0d1f89a.

📒 Files selected for processing (1)

• .github/workflows/release.yaml

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

---

📝 Walkthrough

Walkthrough

This PR adds explanatory comments to the release workflow documenting npm OIDC trusted publishing prerequisites for the @photon-ai/cli package. The comments outline required npmjs.com configuration and note the need for use-oidc: true and id-token: write settings in future workflow implementations.

Changes

npm OIDC Documentation

Layer / File(s)	Summary
OIDC trusted publishing prerequisites documentation .github/workflows/release.yaml	Explanatory comments document npm OIDC trusted publishing prerequisites and required configuration assumptions for @photon-ai/cli, including use-oidc: true and id-token: write directives for maintainers.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• photon-hq/cli#27: Related PR that implements the actual OIDC publishing configuration in the same workflow file that this PR documents.
• photon-hq/cli#11: Related PR that establishes the npm publish/release workflow setup in release.yaml.

Poem

🐰 A workflow well-documented,
Notes for maintainers—now connected!
OIDC trust, plainly said,
Future builders, well fed. 📋✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/cut-release-oidc

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}