chore(ci): switch to OIDC trusted publishing and harden workflows

[cchanxzy]

Switch to OIDC Trusted Publishing and harden CI workflows

Summary

• Replace static NPM_TOKEN secret with OIDC trusted publishing in the release workflow
• Add explicit least-privilege permissions blocks to all workflows missing them (pr.yml, playwright.yml, examples.yml)
• Upgrade JamesIves/github-pages-deploy-action from v3.6.2 to v4 in examples.yml
• Upgrade github/codeql-action from v2 to v3 in codeql-analysis.yml
• Upgrade actions/checkout to v5, actions/setup-node to v6, actions/upload-artifact to v5 across all workflows
• Upgrade Node.js from 22 to 24 across all workflows

Why

npm revoked all classic (legacy) tokens in December 2025. Granular access tokens with write permissions are capped at 90 days, requiring manual rotation. OIDC trusted publishing eliminates long-lived tokens entirely -- GitHub Actions proves its identity directly to npm using short-lived credentials scoped to a single job run.

Workflows without explicit permissions blocks run with overly broad default permissions. Pinning to least-privilege reduces blast radius if a workflow is compromised. Outdated actions (CodeQL v2, github-pages-deploy v3) miss security patches and may lose upstream support.

Changes by workflow

Workflow	Change
release.yml	Add permissions block with id-token: write, remove NPM_TOKEN env var
pr.yml	Add permissions: contents: read
playwright.yml	Add permissions: contents: read
examples.yml	Add permissions: contents: write, upgrade deploy action to v4
codeql-analysis.yml	Upgrade codeql-action from v2 to v3
All workflows	actions/checkout v5, actions/setup-node v6, Node.js 24
playwright.yml	actions/upload-artifact v5

[github-actions]

🎉 This PR is included in version 4.0.4 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀