ci: migrate publish workflow to OIDC, tag-based trigger, and Node 24

[Copilot]

Replaces the token-authenticated, release-event-triggered publish workflow with a modern OIDC-based setup triggered on v* tag pushes.

Changes

• Trigger: release: created → push: tags: v*
• Auth: Removed NPM_TOKEN/NPM_AUTH_TOKEN secrets; added id-token: write + contents: read permissions for OIDC
• Runtime: actions/checkout@v4 + actions/setup-node@v4 (Node lts/*) → @v6 (Node 24)
• Caching: Explicitly disabled via package-manager-cache: false to ensure clean release builds
• Steps: Replaced Makefile wrappers (make install/build/lint/test/publish) with direct npm commands (npm ci, npm run build --if-present, npm test, npm publish); removed linting from release pipeline

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.27%. Comparing base (cf240a9) to head (3e1deb6).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #113   +/-   ##
=======================================
  Coverage   86.27%   86.27%           
=======================================
  Files           6        6           
  Lines         102      102           
  Branches       20       20           
=======================================
  Hits           88       88           
  Misses          6        6           
  Partials        8        8           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.