ci: migrate npm publish to OIDC

Author: atomiks

.github/workflows/release.yml

@@ -55,6 +55,9 @@ jobs:
           node-version: 'lts/*'
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Install npm >= 11.5.1 (required for OIDC publishing)
+        run: npm install -g npm@^11.5.1
+
       - name: 'Install Dependencies'
         run: pnpm install --frozen-lockfile
 
@@ -82,7 +85,7 @@ jobs:
           commit: "[ci] release"
           title: "[ci] release"
         env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Workaround for changesets/action requiring this var to be set.
+          # OIDC trusted publishing does not use an npm token secret.
+          NPM_TOKEN: ""