feat(release): migrate js sdk to npm trusted publishers and decouple sdk releases from ci

[paralta]

Updates the SDK release process to use npm Trusted Publishers for OIDC-based authentication and makes SDK releases a manual step separate from the main release workflow.

• Replace NODE_AUTH_TOKEN with OIDC trusted publishing for npm (adds id-token: write permission)
• Remove SDK job from automated release workflow; now triggered manually via workflow_dispatch
• Remove NPMJS_TOKEN and PYPI_API_TOKEN secrets from CI workflows
• Update RELEASE.md with manual SDK release instructions
• Clean up Taskfile.yml and .npmrc to remove token references

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf CI / verify-proto (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	⏩ skipped	⏩ skipped	✅ passed	Jan 9, 2026, 2:22 PM

[ramizpolic]

@paralta what is the reason behind having to release packages manually? afaik the process can still work automatically, even with this approach, since we can specify id-token as the requirement and pass it from the main workflow

[paralta]

@ramizpolic The SDK release workflow was moved to manual execution because version conflicts (when a version has already been pushed) cause the entire CI pipeline to fail and block. Once the SDK release process is more reliable at handling these cases, we can re-integrate it into the automated CI workflow.

[ramizpolic]

Once the SDK release process is more reliable at handling these cases, we can re-integrate it into the automated CI workflow.

we may want to track this as a separate issue for the future, or alternatively to switch to release-please method for all artifacts