chore: update npm package workflow

[MotherJammer]

This PR updates the CI/CD pipeline to use npm Trusted Publishing (OIDC) instead of the deprecated classic automation tokens.

Changes

• Added permissions: id-token: write to enable OIDC authentication.
• Upgraded actions/setup-node from v1 to v4.
• Switched from npm install to npm ci for clean, deterministic builds.
• Added the --provenance flag to the publish command to sign the package (security best practice).
• Removed the dependency on the static NPM_AUTH_TOKEN secret. The workflow now leverages the automatic GITHUB_TOKEN for the OIDC exchange.