Fix npm trusted publishing

[kieran-osgood-shopify]

What changes are you making?

This works confirmed by workflow_dispatch: https://github.com/Shopify/checkout-sheet-kit-react-native/actions/runs/32992451044

Fix npm trusted publishing after the pnpm migration removed the global npm 11 installation.

The publish workflow now mirrors Shopify/checkout-kit by:

• running the OIDC-compatible npm 11.5.1 CLI through pnpm dlx;
• clearing both npm token environment variables so npm uses GitHub OIDC;
• publishing signed provenance;
• disabling lifecycle scripts and git checks in the privileged publish step.

This fixes the misleading E404 encountered while publishing 3.9.0.

How to test

Given @shopify/checkout-sheet-kit@3.9.0 is not yet published and npm trusted publishing is configured for this repository, when Publish NPM Package is manually dispatched against this branch, then the publish step should authenticate through OIDC, record signed provenance, and publish version 3.9.0 under the latest tag instead of failing with E404.

---

PR Checklist

• I have read and agree with the Contribution Guidelines.
• I have read and agree with the Code of Conduct.
• I've added tests to support my implementation.
• I've updated the README.

[github-actions]

Coverage Report

Lines	Statements	Branches	Functions
	99.12% (227/229)	94.61% (123/130)	100% (67/67)

[kieran-osgood-shopify]

Merge activity

• Aug 26, 5:27 PM UTC: @kieran-osgood-shopify merged this pull request with Graphite.