ci: rename workflow to npm-deploy.yml, switch to npm Trusted Publisher OIDC

- Renames file to match registered trusted publisher workflow name
- Adds id-token: write for OIDC authentication
- Removes NPM_TOKEN (not needed with trusted publishers)
- Adds --provenance flag for npm attestation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

.github/workflows/npm-publish.yml .github/workflows/npm-deploy.yml.github/workflows/npm-publish.yml renamed to .github/workflows/npm-deploy.yml

@@ -10,6 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -22,6 +23,4 @@ jobs:
 
       - run: npm test
 
-      - run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - run: npm publish --access public --provenance